theory ArchVSpace_AI

lemma set_pd_valid_vs_lookup_map:
  "\<lbrace>valid_vs_lookup and valid_arch_state and valid_vspace_objs and
    obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) =
                 vs_refs ko - T \<union> S) p and
    (\<lambda>s. \<forall>x\<in>S. page_table_at (snd x) s) and
    obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) =
                 vs_refs_pages ko - T' \<union> S') p and
    (\<lambda>s. \<forall>(r, p')\<in>S. \<forall>ao. (\<exists>\<rhd> p) s \<longrightarrow>
                           ko_at (ArchObj ao) p' s \<longrightarrow> valid_vspace_obj ao s) and
    (\<lambda>s. (\<exists>\<rhd> p) s \<longrightarrow> valid_vspace_obj (PageDirectory pd) s) and
    (\<lambda>s. \<forall>r. (r \<unrhd> p) s \<longrightarrow>
             (\<forall>c\<in>- kernel_mapping_slots. \<forall>q.
                 pde_ref_pages (pd c) = Some q \<longrightarrow>
                    (\<exists>p' cap. caps_of_state s p' = Some cap \<and>
                         q \<in> obj_refs cap \<and> vs_cap_ref cap =
         Some (VSRef (ucast c) (Some APageDirectory) # r)))) and
    (\<lambda>s. \<forall>r. (r \<unrhd> p) s \<longrightarrow>
             (\<forall>c\<in>- kernel_mapping_slots. \<forall>q.
                 pde_ref (pd c) = Some q \<longrightarrow>
                    (\<forall>q' pt d. ko_at (ArchObj (PageTable pt)) q s \<longrightarrow>
                        pte_ref_pages (pt d) = Some q' \<longrightarrow>
                        (\<exists>p' cap. caps_of_state s p' = Some cap \<and>
                                  q' \<in> obj_refs cap \<and> vs_cap_ref cap =
         Some (VSRef (ucast d) (Some APageTable) #
               VSRef (ucast c) (Some APageDirectory) # r)))))\<rbrace>
   set_pd p pd
   \<lbrace>\<lambda>rv. valid_vs_lookup\<rbrace>" using set_pd_vspace_objs_map[where p=p and pd=pd and T=T and S=S]
        set_pd_valid_arch[of p pd] apply (clarsimp simp: valid_def simpler_set_pd_def) apply (drule_tac x=s in spec)+ apply (clarsimp simp: valid_vs_lookup_def  split: if_split_asm) apply (subst caps_of_state_after_update[folded fun_upd_apply],
         simp add: obj_at_def) apply (erule (1) vs_lookup_pagesE_alt) apply (clarsimp simp: valid_arch_state_def valid_asid_table_def
                            fun_upd_def) apply (drule_tac x=pa in spec) apply simp apply (drule vs_lookup_pages_atI) apply simp apply (drule_tac x=pa in spec) apply (drule_tac x="[VSRef (ucast b) (Some AASIDPool),
                         VSRef (ucast a) None]" in spec)+ apply simp apply (drule vs_lookup_pages_apI) apply (simp split: if_split_asm) apply (simp+)[2] apply (frule_tac s="s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>"
                 in vs_lookup_pages_pdI[rotated -1]) apply (simp del: fun_upd_apply)+ apply (frule vs_lookup_pages_apI) apply (simp split: if_split_asm)+ apply (thin_tac "\<forall>r. (r \<unrhd> p) s \<longrightarrow> Q r" for Q)+ apply (thin_tac "P \<longrightarrow> Q" for P Q)+ apply (drule_tac x=pa in spec) apply (drule_tac x="[VSRef (ucast c) (Some APageDirectory),
                        VSRef (ucast b) (Some AASIDPool),
                        VSRef (ucast a) None]" in spec) apply (erule impE) apply (erule vs_lookup_pages_pdI) apply simp+ apply (thin_tac "\<forall>r. (r \<unrhd> p) s \<longrightarrow> Q r" for Q) apply (thin_tac "P \<longrightarrow> Q" for P Q)+ apply (case_tac "p=p\<^sub>2") apply (thin_tac "\<forall>p ref. P p ref" for P) apply (frule vs_lookup_pages_apI) apply (simp split: if_split_asm) apply simp+ apply (drule spec, erule impE, assumption) apply (clarsimp split: if_split_asm) apply (drule bspec, fastforce) apply (simp add: pde_ref_def obj_at_def) apply (thin_tac "\<forall>r. (r \<unrhd> p) s \<longrightarrow> Q r" for Q) apply (clarsimp split: if_split_asm) apply (drule (7) vs_lookup_pages_ptI) apply simp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_vs_lookup and valid_arch_state and valid_vspace_objs and obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p and (\<lambda>s. \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s) and obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p and (\<lambda>s. \<forall>(r, p')\<in>S. \<forall>ao. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s) and (\<lambda>s. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> valid_vspace_obj (PageDirectory pd) s) and (\<lambda>s. \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>p' cap. caps_of_state s p' = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))) and (\<lambda>s. \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt d. ako_at (PageTable pt) q s \<longrightarrow> pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>p' cap. caps_of_state s p' = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))\<rbrace> set_pd p pd \<lbrace>\<lambda>rv. valid_vs_lookup\<rbrace> proof (prove)
using this:
\<lbrace>valid_vspace_objs and obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p and (\<lambda>s. \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s) and (\<lambda>s. \<forall>(r, p')\<in>S. \<forall>ao. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s) and (\<lambda>s. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> valid_vspace_obj (PageDirectory pd) s)\<rbrace> set_pd p pd \<lbrace>\<lambda>_. valid_vspace_objs\<rbrace>
\<lbrace>valid_arch_state\<rbrace> set_pd p pd \<lbrace>\<lambda>_. valid_arch_state\<rbrace>

goal (1 subgoal):
 1. \<lbrace>valid_vs_lookup and valid_arch_state and valid_vspace_objs and obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p and (\<lambda>s. \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s) and obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p and (\<lambda>s. \<forall>(r, p')\<in>S. \<forall>ao. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s) and (\<lambda>s. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> valid_vspace_obj (PageDirectory pd) s) and (\<lambda>s. \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>p' cap. caps_of_state s p' = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))) and (\<lambda>s. \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt d. ako_at (PageTable pt) q s \<longrightarrow> pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>p' cap. caps_of_state s p' = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))\<rbrace> set_pd p pd \<lbrace>\<lambda>rv. valid_vs_lookup\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s pda. \<lbrakk>\<forall>s. valid_vspace_objs s \<and> obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s \<and> (\<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s) \<and> (\<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s)) \<and> ((\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s)) \<longrightarrow> (\<forall>x\<in>fst (if \<exists>pd. kheap s p = Some (ArchObj (PageDirectory pd)) then ({((), s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)}, False) else ({}, True)). case x of (r, s') \<Rightarrow> valid_vspace_objs s'); \<forall>s. valid_arch_state s \<longrightarrow> (\<forall>x\<in>fst (if \<exists>pd. kheap s p = Some (ArchObj (PageDirectory pd)) then ({((), s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)}, False) else ({}, True)). case x of (r, s') \<Rightarrow> valid_arch_state s'); kheap s p = Some (ArchObj (PageDirectory pda)); valid_vs_lookup s; valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r)))))\<rbrakk> \<Longrightarrow> valid_vs_lookup (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>s pda. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_vs_lookup s; valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs s \<and> obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s \<and> (\<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s) \<and> (\<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s)) \<and> ((\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s)) \<longrightarrow> (\<forall>x\<in>fst (if \<exists>pd. kheap s p = Some (ArchObj (PageDirectory pd)) then ({((), s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)}, False) else ({}, True)). case x of (r, s') \<Rightarrow> valid_vspace_objs s'); valid_arch_state s \<longrightarrow> (\<forall>x\<in>fst (if \<exists>pd. kheap s p = Some (ArchObj (PageDirectory pd)) then ({((), s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)}, False) else ({}, True)). case x of (r, s') \<Rightarrow> valid_arch_state s')\<rbrakk> \<Longrightarrow> valid_vs_lookup (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) proof (prove)
goal (1 subgoal):
 1. \<And>s pda pa ref. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); (ref \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (a, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref) proof (prove)
goal (1 subgoal):
 1. \<And>s pda pa ref. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); (ref \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref) proof (prove)
goal (5 subgoals):
 1. \<And>s pda pa ref. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>pa\<in>ran (asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)). typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)
 2. \<And>s pda pa ref a. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some pa; typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pda pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 5. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (4 subgoals):
 1. \<And>s pda pa ref a. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some pa; typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pda pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (4 subgoals):
 1. \<And>s pda pa ref a. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some pa; typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); \<forall>ref. (ref \<unrhd> pa) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pda pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (4 subgoals):
 1. \<And>s pda pa a. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>(r, p')\<in>S. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some pa; typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); \<forall>ref. (ref \<unrhd> pa) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref)\<rbrakk> \<Longrightarrow> \<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pda pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (4 subgoals):
 1. \<And>s pda pa a. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>(r, p')\<in>S. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); typ_at (AArch AASIDPool) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); \<forall>ref. (ref \<unrhd> pa) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); ([VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s\<rbrakk> \<Longrightarrow> \<exists>aa b cap. caps_of_state s (aa, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pda pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (3 subgoals):
 1. \<And>s pda pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (3 subgoals):
 1. \<And>s pda pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); \<forall>ref. (ref \<unrhd> pa) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (3 subgoals):
 1. \<And>s pda pa ref a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])))); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (3 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>(r, p')\<in>S. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])))); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (5 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>(r, p')\<in>S. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])))); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> kheap s p\<^sub>1 = Some (ArchObj (ASIDPool (?ap68 s pda pa a p\<^sub>1 ap b)))
 2. \<And>s pda pa a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>(r, p')\<in>S. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])))); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> ?ap68 s pda pa a p\<^sub>1 ap b (?b68 s pda pa a p\<^sub>1 ap b) = Some (?p68 s pda pa a p\<^sub>1 ap b)
 3. \<And>s pda pa a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>(r, p')\<in>S. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])))); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]); ([VSRef (UCAST(10 \<rightarrow> 32) (?b68 s pda pa a p\<^sub>1 ap b)) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> ?p68 s pda pa a p\<^sub>1 ap b) s\<rbrakk> \<Longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 5. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (4 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>(r, p')\<in>S. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])))); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> ap (?b68 s pda pa a p\<^sub>1 ap b) = Some (?p68 s pda pa a p\<^sub>1 ap b)
 2. \<And>s pda pa a p\<^sub>1 ap b. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>(r, p')\<in>S. (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some pa; typ_at (AArch APageDirectory) pa (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])))); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]); ([VSRef (UCAST(10 \<rightarrow> 32) (?b68 s pda pa a p\<^sub>1 ap b)) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> ?p68 s pda pa a p\<^sub>1 ap b) s\<rbrakk> \<Longrightarrow> (UCAST(10 \<rightarrow> 32) b = 0 \<longrightarrow> UCAST(7 \<rightarrow> 32) a \<noteq> 0) \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 3. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 4. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (2 subgoals):
 1. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 2. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (7 subgoals):
 1. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (?a87 s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c) = Some (?p\<^sub>187 s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c)
 2. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (?p\<^sub>187 s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c) = Some (ArchObj (ASIDPool (?ap87 s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c)))
 3. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> ?ap87 s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c (?b87 s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c) = Some (?p\<^sub>287 s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c)
 4. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (?p\<^sub>287 s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c) = Some (ArchObj (PageDirectory pdaa))
 5. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> c \<notin> kernel_mapping_slots
 6. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) (?b87 s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c)) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (?a87 s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c)) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])
 7. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (2 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; ((kheap s)(p \<mapsto> ArchObj (PageDirectory pd))) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; ((kheap s)(p \<mapsto> ArchObj (PageDirectory pd))) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (4 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; ((kheap s)(p \<mapsto> ArchObj (PageDirectory pd))) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; ((kheap s)(p \<mapsto> ArchObj (PageDirectory pd))) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> kheap s p\<^sub>1 = Some (ArchObj (ASIDPool (?ap91 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c)))
 2. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; ((kheap s)(p \<mapsto> ArchObj (PageDirectory pd))) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; ((kheap s)(p \<mapsto> ArchObj (PageDirectory pd))) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> ?ap91 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c (?b91 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c) = Some (?p91 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c)
 3. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; ((kheap s)(p \<mapsto> ArchObj (PageDirectory pd))) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; ((kheap s)(p \<mapsto> ArchObj (PageDirectory pd))) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) (?b91 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c)) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> ?p91 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c) s\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 4. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (2 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s; kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (2 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s; kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (2 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s; kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (2 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s; kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); \<forall>ref. (ref \<unrhd> pa) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref)\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (2 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s; kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s \<longrightarrow> [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (3 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s; kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa))\<rbrakk> \<Longrightarrow> ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s
 2. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s; kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 3. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (7 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s; kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa))\<rbrakk> \<Longrightarrow> kheap s p\<^sub>1 = Some (ArchObj (ASIDPool (?ap148 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c)))
 2. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s; kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa))\<rbrakk> \<Longrightarrow> ?ap148 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c b = Some (?p\<^sub>2148 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c)
 3. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s; kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa))\<rbrakk> \<Longrightarrow> kheap s (?p\<^sub>2148 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c) = Some (ArchObj (PageDirectory (?pd148 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c)))
 4. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s; kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa))\<rbrakk> \<Longrightarrow> c \<notin> kernel_mapping_slots
 5. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s; kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa))\<rbrakk> \<Longrightarrow> pde_ref_pages (?pd148 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c c) = Some pa
 6. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c. \<lbrakk>c \<notin> kernel_mapping_slots; pde_ref_pages (pdaa c) = Some pa; valid_pde (pdaa c) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s; kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; p\<^sub>2 \<noteq> p; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 7. \<And>s pda pa ref a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) a = Some p\<^sub>1; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; kheap (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>) (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]) proof (prove)
goal (1 subgoal):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref_pages (pd c) = Some q \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (1 subgoal):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (1 subgoal):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>)\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p = p\<^sub>2\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p \<noteq> p\<^sub>2\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p = p\<^sub>2\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p \<noteq> p\<^sub>2\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (4 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p = p\<^sub>2\<rbrakk> \<Longrightarrow> kheap s p\<^sub>1 = Some (ArchObj (ASIDPool (?ap171 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d)))
 2. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p = p\<^sub>2\<rbrakk> \<Longrightarrow> ?ap171 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d (?b171 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d) = Some (?p171 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d)
 3. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p = p\<^sub>2; ([VSRef (UCAST(10 \<rightarrow> 32) (?b171 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d)) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> ?p171 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d) s\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 4. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p \<noteq> p\<^sub>2\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (3 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p = p\<^sub>2\<rbrakk> \<Longrightarrow> ap (?b171 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d) = Some (?p171 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d)
 2. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p = p\<^sub>2; ([VSRef (UCAST(10 \<rightarrow> 32) (?b171 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d)) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> ?p171 s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d) s\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 3. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p \<noteq> p\<^sub>2\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pdaa)) = vs_refs ko - T \<union> S) p\<^sub>2 s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pdaa)) = vs_refs_pages ko - T' \<union> S') p\<^sub>2 s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p\<^sub>2) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p\<^sub>2) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pdaa c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p\<^sub>2 \<mapsto> ArchObj (PageDirectory pdaa))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p\<^sub>2 \<mapsto> ArchObj (PageDirectory pdaa))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p\<^sub>2 then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; pd = pdaa; c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p\<^sub>2 then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p\<^sub>2 \<mapsto> ArchObj (PageDirectory pdaa))\<rparr>); p = p\<^sub>2; ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p \<noteq> p\<^sub>2\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pdaa)) = vs_refs ko - T \<union> S) p\<^sub>2 s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pdaa)) = vs_refs_pages ko - T' \<union> S') p\<^sub>2 s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p\<^sub>2) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p\<^sub>2 \<mapsto> ArchObj (PageDirectory pdaa))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p\<^sub>2 \<mapsto> ArchObj (PageDirectory pdaa))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p\<^sub>2 then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; pd = pdaa; c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p\<^sub>2 then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p\<^sub>2 \<mapsto> ArchObj (PageDirectory pdaa))\<rparr>); p = p\<^sub>2; ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p\<^sub>2) s; \<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pdaa c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p \<noteq> p\<^sub>2\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b c addr x y pt d. \<lbrakk>pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s; \<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]))); kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p \<noteq> p\<^sub>2\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (2 subgoals):
 1. \<And>s pda pa a p\<^sub>1 ap b c addr x y pt d. \<lbrakk>pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); ([VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> p) s; kheap s p = Some (ArchObj (PageDirectory pda)); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p; c \<notin> kernel_mapping_slots; pd c = PageTablePDE addr x y; ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None])))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None]
 2. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p \<noteq> p\<^sub>2\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (1 subgoal):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); \<forall>r. (r \<unrhd> p) s \<longrightarrow> (\<forall>c\<in>- kernel_mapping_slots. \<forall>q. pde_ref (pd c) = Some q \<longrightarrow> (\<forall>q' pt. ako_at (PageTable pt) q s \<longrightarrow> (\<forall>d. pte_ref_pages (pt d) = Some q' \<longrightarrow> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> q' \<in> obj_refs cap \<and> vs_cap_ref cap = Some (VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable) # VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory) # r))))); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p \<noteq> p\<^sub>2\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (1 subgoal):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; (if p\<^sub>1 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>1) = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; (if p\<^sub>2 = p then Some (ArchObj (PageDirectory pd)) else kheap s p\<^sub>2) = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; (if ptrFromPAddr addr = p then Some (ArchObj (PageDirectory pd)) else kheap s (ptrFromPAddr addr)) = Some (ArchObj (PageTable pt)); pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p \<noteq> p\<^sub>2\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (1 subgoal):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p \<noteq> p\<^sub>2; kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); asid_table s a = Some p\<^sub>1; p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal (1 subgoal):
 1. \<And>s pda pa a p\<^sub>1 ap b p\<^sub>2 pdaa c addr x y pt d. \<lbrakk>pte_ref_pages (pt d) = Some pa; valid_pte (pt d) (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p \<noteq> p\<^sub>2; kheap s p = Some (ArchObj (PageDirectory pda)); \<forall>p ref. (ref \<unrhd> p) s \<longrightarrow> ref \<noteq> [VSRef 0 (Some AASIDPool), VSRef 0 None] \<and> (\<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> p \<in> obj_refs cap \<and> vs_cap_ref cap = Some ref); valid_arch_state s; valid_vspace_objs s; obj_at (\<lambda>ko. vs_refs (ArchObj (PageDirectory pd)) = vs_refs ko - T \<union> S) p s; \<forall>x\<in>S. typ_at (AArch APageTable) (snd x) s; obj_at (\<lambda>ko. vs_refs_pages (ArchObj (PageDirectory pd)) = vs_refs_pages ko - T' \<union> S') p s; \<forall>x\<in>S. case x of (r, p') \<Rightarrow> (\<exists>ref. (ref \<rhd> p) s) \<longrightarrow> (\<forall>ao. ako_at ao p' s \<longrightarrow> valid_vspace_obj ao s); valid_vspace_objs (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); valid_arch_state (s\<lparr>kheap := (kheap s)(p \<mapsto> ArchObj (PageDirectory pd))\<rparr>); p\<^sub>1 \<noteq> p; kheap s p\<^sub>1 = Some (ArchObj (ASIDPool ap)); ap b = Some p\<^sub>2; kheap s p\<^sub>2 = Some (ArchObj (PageDirectory pdaa)); c \<notin> kernel_mapping_slots; pdaa c = PageTablePDE addr x y; ptrFromPAddr addr \<noteq> p; kheap s (ptrFromPAddr addr) = Some (ArchObj (PageTable pt)); ([VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] \<unrhd> pa) s\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> pa \<in> obj_refs cap \<and> vs_cap_ref cap = Some [VSRef (UCAST(8 \<rightarrow> 32) d) (Some APageTable), VSRef (UCAST(12 \<rightarrow> 32) c) (Some APageDirectory), VSRef (UCAST(10 \<rightarrow> 32) b) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) a) None] proof (prove)
goal:
No subgoals!