theory ArchArch_AI

lemma aci_invs':
  assumes Q_ignores_arch[simp]: "\<And>f s. Q (arch_state_update f s) = Q s"
  assumes Q_ignore_machine_state[simp]: "\<And>f s. Q (machine_state_update f s) = Q s"
  assumes Q_detype[simp]: "\<And>f s. Q (detype f s) = Q s"
  assumes cap_insert_Q: "\<And>cap src dest. \<lbrace>Q and invs and K (src \<noteq> dest)\<rbrace>
                            cap_insert cap src dest
                           \<lbrace>\<lambda>_.Q\<rbrace>"
  assumes retype_region_Q[wp]:"\<And>a b c d e. \<lbrace>Q\<rbrace> retype_region a b c d e \<lbrace>\<lambda>_.Q\<rbrace>"
  assumes set_cap_Q[wp]: "\<And>a b. \<lbrace>Q\<rbrace> set_cap a b \<lbrace>\<lambda>_.Q\<rbrace>"
  shows "\<lbrace>invs and Q and ct_active and valid_aci aci\<rbrace> perform_asid_control_invocation aci \<lbrace>\<lambda>y s. invs s \<and> Q s\<rbrace>" proof - have cap_insert_invsQ:
       "\<And>cap src dest ap asid.
        \<lbrace>Q and (invs and valid_cap cap and tcb_cap_valid cap dest and
         ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and
         cte_wp_at (\<lambda>c. c = NullCap) dest and
         no_cap_to_obj_with_diff_ref cap {dest} and
         (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and
         K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and
         (\<lambda>s. \<forall>irq\<in>cap_irqs cap. irq_issued irq s) and
         ko_at (ArchObj (ASIDPool Map.empty)) ap and
         (\<lambda>s. ap \<notin> ran (asid_table s) \<and>
         asid_table s (asid_high_bits_of asid) = None))\<rbrace>
         cap_insert cap src dest
        \<lbrace>\<lambda>rv s.
           invs
             (s\<lparr>arch_state := arch_state s
                 \<lparr>arm_asid_table := ((arm_asid_table \<circ> arch_state) s)
                    (asid_high_bits_of asid \<mapsto> ap)\<rparr>\<rparr>) \<and>
           Q
             (s\<lparr>arch_state := arch_state s
                 \<lparr>arm_asid_table := ((arm_asid_table \<circ> arch_state) s)
                    (asid_high_bits_of asid \<mapsto> ap)\<rparr>\<rparr>)\<rbrace>" apply (wp cap_insert_ap_invs) apply simp apply (rule hoare_pre) apply (rule cap_insert_Q, assumption) apply (auto simp: cte_wp_at_caps_of_state) done show ?thesis apply (clarsimp simp: perform_asid_control_invocation_def valid_aci_def
                    split: asid_control_invocation.splits) apply (rename_tac word1 a b aa ba word2) apply (rule hoare_pre) apply (wp hoare_vcg_const_imp_lift) apply (wp cap_insert_invsQ hoare_vcg_ex_lift | simp)+ apply (simp add: valid_cap_def |
               strengthen real_cte_tcb_valid safe_parent_strg
                          invs_vobjs_strgs
                          ex_cte_cap_to_cnode_always_appropriate_strg)+ apply (wp hoare_vcg_const_imp_lift set_free_index_invs
                  retype_region_plain_invs[where sz = pageBits]
                  retype_cte_wp_at[where sz = pageBits] hoare_vcg_ex_lift
                  retype_region_obj_at_other3[where P="is_cap_table n" and sz = pageBits for n]
                  retype_region_ex_cte_cap_to[where sz = pageBits]
                  retype_region_ap[simplified]
                  retype_region_ap'[simplified]
                  retype_region_no_cap_to_obj[where sz = pageBits,simplified]
                   | simp del: split_paired_Ex)+ apply (strengthen invs_valid_objs invs_psp_aligned
              invs_mdb invs_valid_pspace
              exI[where x="case aci of MakePool frame slot parent base \<Rightarrow> parent"]
              exI[where x="case aci of MakePool frame slot parent base \<Rightarrow> parent",
                simplified]
              caps_region_kernel_window_imp[where
                p = "case aci of MakePool frame slot parent base \<Rightarrow> parent"]
              invs_cap_refs_in_kernel_window)+ apply (wp set_cap_caps_no_overlap set_cap_no_overlap get_cap_wp
                 max_index_upd_caps_overlap_reserved max_index_upd_invs_simple
                 set_cap_cte_cap_wp_to set_cap_cte_wp_at max_index_upd_no_cap_to
              | simp split del: if_split | wp (once) hoare_vcg_ex_lift)+ apply (rule_tac P = "is_aligned word1 page_bits" in hoare_gen_asm) apply (subst delete_objects_rewrite) apply (simp add:page_bits_def pageBits_def word_size_bits_def) apply (simp add:page_bits_def pageBits_def word_bits_def) apply (simp) apply wp apply (clarsimp simp: cte_wp_at_caps_of_state if_option_Some
                          if_bool_simps
               split del: if_split) apply (frule_tac cap = "(cap.UntypedCap False word1 pageBits idx)"
                     in detype_invariants[rotated 3],clarsimp+) apply (simp add:cte_wp_at_caps_of_state)+ apply (simp add:descendants_range_def2 empty_descendants_range_in) apply (simp add:invs_mdb invs_valid_pspace invs_psp_aligned invs_valid_objs) apply (clarsimp dest!:caps_of_state_cteD) apply (frule(1) unsafe_protected[where p=t and p'=t for t]) apply (simp add:empty_descendants_range_in)+ apply fastforce apply clarsimp apply (frule_tac p = "(aa,ba)" in cte_wp_valid_cap) apply fastforce apply (clarsimp simp: detype_clear_um_independent obj_bits_api_def arch_kobj_size_def
                          default_arch_object_def conj_comms) apply (rule conjI, clarsimp simp:valid_cap_simps cap_aligned_def page_bits_def not_le)+ apply clarsimp apply (simp add:empty_descendants_range_in) apply (frule valid_cap_aligned) apply (clarsimp simp: cap_aligned_def) apply (subst caps_no_overlap_detype[OF descendants_range_caps_no_overlapI],
           assumption, simp, simp add: empty_descendants_range_in) apply (frule pspace_no_overlap_detype, clarify+) apply (frule intvl_range_conv[where bits = pageBits]) apply (simp add:pageBits_def word_bits_def) apply (simp) apply (clarsimp simp: page_bits_def) apply (frule(1) ex_cte_cap_protects) apply (simp add:empty_descendants_range_in) apply fastforce apply (rule subset_refl) apply fastforce apply (clarsimp simp: field_simps) apply (intro conjI impI,
           simp_all add: free_index_of_def valid_cap_simps valid_untyped_def empty_descendants_range_in
                         range_cover_full clear_um_def max_free_index_def,
           (clarsimp simp:valid_untyped_def valid_cap_simps)+)[1] apply (simp add: cte_wp_at_def) apply (erule(1) cap_to_protected) apply (simp add:empty_descendants_range_in descendants_range_def2)+ apply clarsimp apply (drule invs_arch_state)+ apply (clarsimp simp: valid_arch_state_def valid_asid_table_def) apply (drule (1) bspec)+ apply clarsimp apply (erule notE, erule is_aligned_no_overflow) apply (clarsimp simp: no_cap_to_obj_with_diff_ref_def) apply (thin_tac "cte_wp_at ((=) cap.NullCap) p s" for p s) apply (subst(asm) eq_commute,
           erule(1) untyped_children_in_mdbE[where cap="cap.UntypedCap dev p bits idx" for dev p bits idx,
                                             simplified, rotated]) apply (simp add: is_aligned_no_overflow) apply simp apply clarsimp done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and Q and ct_active and valid_aci aci\<rbrace> perform_asid_control_invocation aci \<lbrace>\<lambda>y s. invs s \<and> Q s\<rbrace> proof (state)
goal (1 subgoal):
 1. \<lbrace>invs and Q and ct_active and valid_aci aci\<rbrace> perform_asid_control_invocation aci \<lbrace>\<lambda>y s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>cap src dest ap asid. \<lbrace>Q and (invs and valid_cap cap and tcb_cap_valid cap dest and ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and cte_wp_at (\<lambda>c. c = NullCap) dest and no_cap_to_obj_with_diff_ref cap {dest} and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and (\<lambda>s. \<forall>irq\<in>cap_irqs cap. irq_issued irq s) and ako_at (ASIDPool (\<lambda>x. None)) ap and (\<lambda>s. ap \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of asid) = None))\<rbrace> cap_insert cap src dest \<lbrace>\<lambda>rv s. invs (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := ((arm_asid_table \<circ> arch_state) s)(asid_high_bits_of asid \<mapsto> ap)\<rparr>\<rparr>) \<and> Q (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := ((arm_asid_table \<circ> arch_state) s)(asid_high_bits_of asid \<mapsto> ap)\<rparr>\<rparr>)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>cap src dest ap asid. \<lbrace>?P'1 cap src dest ap asid\<rbrace> cap_insert cap src dest \<lbrace>\<lambda>rv s. Q (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := ((arm_asid_table \<circ> arch_state) s)(asid_high_bits_of asid \<mapsto> ap)\<rparr>\<rparr>)\<rbrace>
 2. \<And>cap src dest ap asid s. (Q and (invs and valid_cap cap and tcb_cap_valid cap dest and ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and cte_wp_at (\<lambda>c. c = NullCap) dest and no_cap_to_obj_with_diff_ref cap {dest} and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and (\<lambda>s. \<forall>irq\<in>cap_irqs cap. irq_issued irq s) and ako_at (ASIDPool (\<lambda>x. None)) ap and (\<lambda>s. ap \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of asid) = None))) s \<Longrightarrow> (invs and valid_cap cap and tcb_cap_valid cap dest and ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and cte_wp_at (\<lambda>c. c = NullCap) dest and no_cap_to_obj_with_diff_ref cap {dest} and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and (\<lambda>s. \<forall>irq\<in>cap_irqs cap. irq_issued irq s) and ako_at (ASIDPool (\<lambda>x. None)) ap and (\<lambda>s. ap \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of asid) = None)) s \<and> ?P'1 cap src dest ap asid s proof (prove)
goal (2 subgoals):
 1. \<And>cap src dest ap asid. \<lbrace>?P'1 cap src dest ap asid\<rbrace> cap_insert cap src dest \<lbrace>\<lambda>rv. Q\<rbrace>
 2. \<And>cap src dest ap asid s. (Q and (invs and valid_cap cap and tcb_cap_valid cap dest and ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and cte_wp_at (\<lambda>c. c = NullCap) dest and no_cap_to_obj_with_diff_ref cap {dest} and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and (\<lambda>s. \<forall>irq\<in>cap_irqs cap. irq_issued irq s) and ako_at (ASIDPool (\<lambda>x. None)) ap and (\<lambda>s. ap \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of asid) = None))) s \<Longrightarrow> (invs and valid_cap cap and tcb_cap_valid cap dest and ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and cte_wp_at (\<lambda>c. c = NullCap) dest and no_cap_to_obj_with_diff_ref cap {dest} and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and (\<lambda>s. \<forall>irq\<in>cap_irqs cap. irq_issued irq s) and ako_at (ASIDPool (\<lambda>x. None)) ap and (\<lambda>s. ap \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of asid) = None)) s \<and> ?P'1 cap src dest ap asid s proof (prove)
goal (3 subgoals):
 1. \<And>cap src dest ap asid. \<lbrace>?Q3 cap src dest ap asid\<rbrace> cap_insert cap src dest \<lbrace>\<lambda>rv. Q\<rbrace>
 2. \<And>cap src dest ap asid s. ?P'1 cap src dest ap asid s \<Longrightarrow> ?Q3 cap src dest ap asid s
 3. \<And>cap src dest ap asid s. (Q and (invs and valid_cap cap and tcb_cap_valid cap dest and ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and cte_wp_at (\<lambda>c. c = NullCap) dest and no_cap_to_obj_with_diff_ref cap {dest} and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and (\<lambda>s. \<forall>irq\<in>cap_irqs cap. irq_issued irq s) and ako_at (ASIDPool (\<lambda>x. None)) ap and (\<lambda>s. ap \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of asid) = None))) s \<Longrightarrow> (invs and valid_cap cap and tcb_cap_valid cap dest and ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and cte_wp_at (\<lambda>c. c = NullCap) dest and no_cap_to_obj_with_diff_ref cap {dest} and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and (\<lambda>s. \<forall>irq\<in>cap_irqs cap. irq_issued irq s) and ako_at (ASIDPool (\<lambda>x. None)) ap and (\<lambda>s. ap \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of asid) = None)) s \<and> ?P'1 cap src dest ap asid s proof (prove)
goal (1 subgoal):
 1. \<And>cap src dest ap asid s. (Q and (invs and valid_cap cap and tcb_cap_valid cap dest and ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and cte_wp_at (\<lambda>c. c = NullCap) dest and no_cap_to_obj_with_diff_ref cap {dest} and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and (\<lambda>s. \<forall>irq\<in>cap_irqs cap. irq_issued irq s) and ako_at (ASIDPool (\<lambda>x. None)) ap and (\<lambda>s. ap \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of asid) = None))) s \<Longrightarrow> (invs and valid_cap cap and tcb_cap_valid cap dest and ex_cte_cap_wp_to (appropriate_cte_cap cap) dest and cte_wp_at (\<lambda>c. c = NullCap) dest and no_cap_to_obj_with_diff_ref cap {dest} and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) src cap) src s) and K (cap = ArchObjectCap (ASIDPoolCap ap asid)) and (\<lambda>s. \<forall>irq\<in>cap_irqs cap. irq_issued irq s) and ako_at (ASIDPool (\<lambda>x. None)) ap and (\<lambda>s. ap \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of asid) = None)) s \<and> (Q and invs and K (src \<noteq> dest)) s proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrace>Q and (invs and valid_cap ?cap and tcb_cap_valid ?cap ?dest and ex_cte_cap_wp_to (appropriate_cte_cap ?cap) ?dest and cte_wp_at (\<lambda>c. c = NullCap) ?dest and no_cap_to_obj_with_diff_ref ?cap {?dest} and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) ?src ?cap) ?src s) and K (?cap = ArchObjectCap (ASIDPoolCap ?ap ?asid)) and (\<lambda>s. \<forall>irq\<in>cap_irqs ?cap. irq_issued irq s) and ako_at (ASIDPool (\<lambda>x. None)) ?ap and (\<lambda>s. ?ap \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of ?asid) = None))\<rbrace> cap_insert ?cap ?src ?dest \<lbrace>\<lambda>rv s. invs (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := ((arm_asid_table \<circ> arch_state) s)(asid_high_bits_of ?asid \<mapsto> ?ap)\<rparr>\<rparr>) \<and> Q (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := ((arm_asid_table \<circ> arch_state) s)(asid_high_bits_of ?asid \<mapsto> ?ap)\<rparr>\<rparr>)\<rbrace>

goal (1 subgoal):
 1. \<lbrace>invs and Q and ct_active and valid_aci aci\<rbrace> perform_asid_control_invocation aci \<lbrace>\<lambda>y s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and Q and ct_active and valid_aci aci\<rbrace> perform_asid_control_invocation aci \<lbrace>\<lambda>y s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x1 a b aa ba x4. aci = MakePool x1 (a, b) (aa, ba) x4 \<Longrightarrow> \<lbrace>invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False x1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned x4 local.asid_low_bits \<and> x4 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of x4) = None)\<rbrace> do y <- delete_objects x1 page_bits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region x1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (ArchObjectCap (ASIDPoolCap x1 x4)) (aa, ba) (a, b);
y <- assert (x4 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of x4 \<mapsto> x1)\<rparr>\<rparr>)
od \<lbrace>\<lambda>y s. invs s \<and> Q s\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False word1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of word2) = None)\<rbrace> do y <- delete_objects word1 page_bits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (ArchObjectCap (ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od \<lbrace>\<lambda>y s. invs s \<and> Q s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?Q13 word1 a b aa ba word2\<rbrace> do y <- delete_objects word1 page_bits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (ArchObjectCap (ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od \<lbrace>\<lambda>y s. invs s \<and> Q s\<rbrace>
 2. \<And>word1 a b aa ba word2 s. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; (invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False word1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of word2) = None)) s\<rbrakk> \<Longrightarrow> ?Q13 word1 a b aa ba word2 s proof (prove)
goal (6 subgoals):
 1. \<And>word1 a b aa ba word2 y pcap ya yb. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; word2 && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> \<lbrace>?Q28 word1 a b aa ba word2 y pcap ya yb\<rbrace> cap_insert (ArchObjectCap (ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>rv s. invs (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := ((arm_asid_table \<circ> arch_state) s)(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>) \<and> Q (s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := ((arm_asid_table \<circ> arch_state) s)(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)\<rbrace>
 2. \<And>word1 a b aa ba word2 y pcap ya. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?B19 word1 a b aa ba word2 y pcap ya\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>yb s. word2 && mask local.asid_low_bits = 0 \<longrightarrow> ?Q28 word1 a b aa ba word2 y pcap ya yb s\<rbrace>
 3. \<And>word1 a b aa ba word2 y pcap. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?B18 word1 a b aa ba word2 y pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>?B19 word1 a b aa ba word2 y pcap\<rbrace>
 4. \<And>word1 a b aa ba word2 y. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?B17 word1 a b aa ba word2 y\<rbrace> get_cap (aa, ba) \<lbrace>?B18 word1 a b aa ba word2 y\<rbrace>
 5. \<And>word1 a b aa ba word2. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?Q13 word1 a b aa ba word2\<rbrace> delete_objects word1 page_bits \<lbrace>?B17 word1 a b aa ba word2\<rbrace>
 6. \<And>word1 a b aa ba word2 s. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; (invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False word1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of word2) = None)) s\<rbrakk> \<Longrightarrow> ?Q13 word1 a b aa ba word2 s proof (prove)
goal (5 subgoals):
 1. \<And>word1 a b aa ba word2 pcap. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?B19 word1 a b aa ba word2 () pcap ()\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>yb s. word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q s \<and> invs s \<and> s \<turnstile> ArchObjectCap (ASIDPoolCap word1 word2) \<and> tcb_cap_valid (ArchObjectCap (ASIDPoolCap word1 word2)) (a, b) s \<and> ex_cte_cap_wp_to (appropriate_cte_cap (ArchObjectCap (ASIDPoolCap word1 word2))) (a, b) s \<and> cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} s \<and> cte_wp_at (safe_parent_for (cdt s) (aa, ba) (ArchObjectCap (ASIDPoolCap word1 word2))) (aa, ba) s \<and> ako_at (ASIDPool (\<lambda>x. None)) word1 s \<and> word1 \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of word2) = None\<rbrace>
 2. \<And>word1 a b aa ba word2 y pcap. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?B18 word1 a b aa ba word2 y pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>?B19 word1 a b aa ba word2 y pcap\<rbrace>
 3. \<And>word1 a b aa ba word2 y. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?B17 word1 a b aa ba word2 y\<rbrace> get_cap (aa, ba) \<lbrace>?B18 word1 a b aa ba word2 y\<rbrace>
 4. \<And>word1 a b aa ba word2. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?Q13 word1 a b aa ba word2\<rbrace> delete_objects word1 page_bits \<lbrace>?B17 word1 a b aa ba word2\<rbrace>
 5. \<And>word1 a b aa ba word2 s. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; (invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False word1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of word2) = None)) s\<rbrakk> \<Longrightarrow> ?Q13 word1 a b aa ba word2 s proof (prove)
goal (5 subgoals):
 1. \<And>word1 a b aa ba word2 pcap. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?B19 word1 a b aa ba word2 () pcap ()\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>r s. word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q s \<and> invs s \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> typ_at (AArch AASIDPool) word1 s \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} s \<and> cte_wp_at (\<lambda>cap. cap = UntypedCap False word1 pageBits (?idx52 word1 a b aa ba word2 pcap r s)) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> invs s \<and> ako_at (ASIDPool (\<lambda>x. None)) word1 s \<and> word1 \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of word2) = None\<rbrace>
 2. \<And>word1 a b aa ba word2 y pcap. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?B18 word1 a b aa ba word2 y pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>?B19 word1 a b aa ba word2 y pcap\<rbrace>
 3. \<And>word1 a b aa ba word2 y. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?B17 word1 a b aa ba word2 y\<rbrace> get_cap (aa, ba) \<lbrace>?B18 word1 a b aa ba word2 y\<rbrace>
 4. \<And>word1 a b aa ba word2. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?Q13 word1 a b aa ba word2\<rbrace> delete_objects word1 page_bits \<lbrace>?B17 word1 a b aa ba word2\<rbrace>
 5. \<And>word1 a b aa ba word2 s. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; (invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False word1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of word2) = None)) s\<rbrakk> \<Longrightarrow> ?Q13 word1 a b aa ba word2 s proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 pcap. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; word2 && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> \<lbrace>?P'178 word1 a b aa ba word2 () pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>rv s. caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> caps_overlap_reserved {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} s \<and> region_in_kernel_window {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> \<not> cap_is_device c) slot s) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cap_table_at (length b) a s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> valid_pspace s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> valid_pspace s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> valid_pspace s \<and> valid_mdb s \<and> caps_overlap_reserved {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} s \<and> (\<exists>a b. cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> \<not> cap_is_device c) (a, b) s) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cte_wp_at (\<lambda>c. c = UntypedCap False word1 pageBits (?idx149 word1 a b aa ba word2 () pcap ())) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> valid_pspace s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt s) = {} \<and> invs s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> caps_overlap_reserved {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} s \<and> region_in_kernel_window {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} s \<and> (\<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> \<not> cap_is_device c) slot s) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of word2) = None\<rbrace>
 2. \<And>word1 a b aa ba word2 y. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?B17 word1 a b aa ba word2 y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap s. word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q s \<and> ((free_index_of pcap \<le> max_free_index (untyped_sz_bits pcap) \<and> is_untyped_cap pcap \<and> max_free_index (untyped_sz_bits pcap) \<le> 2 ^ cap_bits pcap) \<and> invs s \<and> cte_wp_at ((=) pcap) (aa, ba) s) \<and> ?P'178 word1 a b aa ba word2 y pcap s\<rbrace>
 3. \<And>word1 a b aa ba word2. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?Q13 word1 a b aa ba word2\<rbrace> delete_objects word1 page_bits \<lbrace>?B17 word1 a b aa ba word2\<rbrace>
 4. \<And>word1 a b aa ba word2 s. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; (invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False word1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of word2) = None)) s\<rbrakk> \<Longrightarrow> ?Q13 word1 a b aa ba word2 s proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 pcap. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; word2 && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> \<lbrace>?P'178 word1 a b aa ba word2 () pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>r s. caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> caps_overlap_reserved {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} s \<and> (\<exists>x. caps_of_state s (case aci of MakePool frame slot parent base \<Rightarrow> parent) = Some x \<and> invs s \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range x) \<and> cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> \<not> cap_is_device c) (case aci of MakePool frame slot parent base \<Rightarrow> parent) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cap_table_at (length b) a s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> invs s \<and> invs s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> invs s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> invs s \<and> invs s \<and> caps_overlap_reserved {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} s \<and> cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> \<not> cap_is_device c) (case aci of MakePool frame slot parent base \<Rightarrow> parent) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cte_wp_at (\<lambda>c. c = UntypedCap False word1 pageBits (?idx149 word1 a b aa ba word2 () pcap ())) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt s) = {} \<and> invs s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> caps_overlap_reserved {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} s \<and> (\<exists>x. caps_of_state s (case aci of MakePool frame slot parent base \<Rightarrow> parent) = Some x \<and> invs s \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range x) \<and> cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> \<not> cap_is_device c) (case aci of MakePool frame slot parent base \<Rightarrow> parent) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of word2) = None\<rbrace>
 2. \<And>word1 a b aa ba word2 y. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?B17 word1 a b aa ba word2 y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap s. word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q s \<and> ((free_index_of pcap \<le> max_free_index (untyped_sz_bits pcap) \<and> is_untyped_cap pcap \<and> max_free_index (untyped_sz_bits pcap) \<le> 2 ^ cap_bits pcap) \<and> invs s \<and> cte_wp_at ((=) pcap) (aa, ba) s) \<and> ?P'178 word1 a b aa ba word2 y pcap s\<rbrace>
 3. \<And>word1 a b aa ba word2. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?Q13 word1 a b aa ba word2\<rbrace> delete_objects word1 page_bits \<lbrace>?B17 word1 a b aa ba word2\<rbrace>
 4. \<And>word1 a b aa ba word2 s. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; (invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False word1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of word2) = None)) s\<rbrakk> \<Longrightarrow> ?Q13 word1 a b aa ba word2 s proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2. aci = MakePool word1 (a, b) (aa, ba) word2 \<Longrightarrow> \<lbrace>?Q13 word1 a b aa ba word2\<rbrace> delete_objects word1 page_bits \<lbrace>\<lambda>y s. \<forall>cap. cte_wp_at ((=) cap) (aa, ba) s \<longrightarrow> word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q s \<and> free_index_of cap \<le> max_free_index (untyped_sz_bits cap) \<and> is_untyped_cap cap \<and> max_free_index (untyped_sz_bits cap) \<le> 2 ^ cap_bits cap \<and> invs s \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cap_table_at (length b) a s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cte_wp_at (\<lambda>cap'. (a, b) \<in> cte_refs cap' (interrupt_irq_node s) \<and> is_cnode_cap cap' \<longrightarrow> (a, b) \<in> cte_refs (max_free_index_update cap) (interrupt_irq_node s) \<and> is_cnode_cap cap) (aa, ba) s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> (if a = aa \<and> b = ba then max_free_index_update cap = NullCap else cte_wp_at (\<lambda>a. a = NullCap) (a, b) s) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} s \<and> is_untyped_cap cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index_update cap = UntypedCap False word1 pageBits (?idx519 word1 a b aa ba word2 () cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt s) = {} \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of word2) = None\<rbrace>
 2. \<And>word1 a b aa ba word2 s. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; (invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False word1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of word2) = None)) s\<rbrakk> \<Longrightarrow> ?Q13 word1 a b aa ba word2 s
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; is_aligned word1 page_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'594 word1 a b aa ba word2\<rbrace> delete_objects word1 page_bits \<lbrace>\<lambda>y s. \<forall>cap. cte_wp_at ((=) cap) (aa, ba) s \<longrightarrow> word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q s \<and> free_index_of cap \<le> max_free_index (untyped_sz_bits cap) \<and> is_untyped_cap cap \<and> max_free_index (untyped_sz_bits cap) \<le> 2 ^ cap_bits cap \<and> invs s \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cap_table_at (length b) a s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cte_wp_at (\<lambda>cap'. (a, b) \<in> cte_refs cap' (interrupt_irq_node s) \<and> is_cnode_cap cap' \<longrightarrow> (a, b) \<in> cte_refs (max_free_index_update cap) (interrupt_irq_node s) \<and> is_cnode_cap cap) (aa, ba) s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> (if a = aa \<and> b = ba then max_free_index_update cap = NullCap else cte_wp_at (\<lambda>a. a = NullCap) (a, b) s) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} s \<and> is_untyped_cap cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index_update cap = UntypedCap False word1 pageBits (?idx519 word1 a b aa ba word2 () cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt s) = {} \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of word2) = None\<rbrace>
 2. \<And>word1 a b aa ba word2 s. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; (invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False word1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of word2) = None)) s\<rbrakk> \<Longrightarrow> (?P'594 word1 a b aa ba word2 and K (is_aligned word1 page_bits)) s
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (5 subgoals):
 1. \<And>word1 a b aa ba word2. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; is_aligned word1 page_bits\<rbrakk> \<Longrightarrow> word_size_bits \<le> page_bits
 2. \<And>word1 a b aa ba word2. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; is_aligned word1 page_bits\<rbrakk> \<Longrightarrow> page_bits \<le> word_bits
 3. \<And>word1 a b aa ba word2. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; is_aligned word1 page_bits\<rbrakk> \<Longrightarrow> word1 && ~~ mask page_bits = word1
 4. \<And>word1 a b aa ba word2. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; is_aligned word1 page_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'597 word1 word1 a a b b aa aa ba ba word2 word2\<rbrace> do y <- modify (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits});
modify (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1})
od \<lbrace>\<lambda>y s. \<forall>cap. cte_wp_at ((=) cap) (aa, ba) s \<longrightarrow> word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q s \<and> free_index_of cap \<le> max_free_index (untyped_sz_bits cap) \<and> is_untyped_cap cap \<and> max_free_index (untyped_sz_bits cap) \<le> 2 ^ cap_bits cap \<and> invs s \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cap_table_at (length b) a s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cte_wp_at (\<lambda>cap'. (a, b) \<in> cte_refs cap' (interrupt_irq_node s) \<and> is_cnode_cap cap' \<longrightarrow> (a, b) \<in> cte_refs (max_free_index_update cap) (interrupt_irq_node s) \<and> is_cnode_cap cap) (aa, ba) s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> (if a = aa \<and> b = ba then max_free_index_update cap = NullCap else cte_wp_at (\<lambda>a. a = NullCap) (a, b) s) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} s \<and> is_untyped_cap cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index_update cap = UntypedCap False word1 pageBits (?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt s) = {} \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of word2) = None\<rbrace>
 5. \<And>word1 a b aa ba word2 s. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; (invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False word1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of word2) = None)) s\<rbrakk> \<Longrightarrow> (?P'597 word1 word1 a a b b aa aa ba ba word2 word2 and K (is_aligned word1 page_bits)) s
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; is_aligned word1 page_bits\<rbrakk> \<Longrightarrow> page_bits \<le> word_bits
 2. \<And>word1 a b aa ba word2. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; is_aligned word1 page_bits\<rbrakk> \<Longrightarrow> word1 && ~~ mask page_bits = word1
 3. \<And>word1 a b aa ba word2. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; is_aligned word1 page_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'597 word1 word1 a a b b aa aa ba ba word2 word2\<rbrace> do y <- modify (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits});
modify (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1})
od \<lbrace>\<lambda>y s. \<forall>cap. cte_wp_at ((=) cap) (aa, ba) s \<longrightarrow> word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q s \<and> free_index_of cap \<le> max_free_index (untyped_sz_bits cap) \<and> is_untyped_cap cap \<and> max_free_index (untyped_sz_bits cap) \<le> 2 ^ cap_bits cap \<and> invs s \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cap_table_at (length b) a s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cte_wp_at (\<lambda>cap'. (a, b) \<in> cte_refs cap' (interrupt_irq_node s) \<and> is_cnode_cap cap' \<longrightarrow> (a, b) \<in> cte_refs (max_free_index_update cap) (interrupt_irq_node s) \<and> is_cnode_cap cap) (aa, ba) s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> (if a = aa \<and> b = ba then max_free_index_update cap = NullCap else cte_wp_at (\<lambda>a. a = NullCap) (a, b) s) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} s \<and> is_untyped_cap cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index_update cap = UntypedCap False word1 pageBits (?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt s) = {} \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of word2) = None\<rbrace>
 4. \<And>word1 a b aa ba word2 s. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; (invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False word1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of word2) = None)) s\<rbrakk> \<Longrightarrow> (?P'597 word1 word1 a a b b aa aa ba ba word2 word2 and K (is_aligned word1 page_bits)) s
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; is_aligned word1 page_bits\<rbrakk> \<Longrightarrow> word1 && ~~ mask page_bits = word1
 2. \<And>word1 a b aa ba word2. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; is_aligned word1 page_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'597 word1 word1 a a b b aa aa ba ba word2 word2\<rbrace> do y <- modify (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits});
modify (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1})
od \<lbrace>\<lambda>y s. \<forall>cap. cte_wp_at ((=) cap) (aa, ba) s \<longrightarrow> word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q s \<and> free_index_of cap \<le> max_free_index (untyped_sz_bits cap) \<and> is_untyped_cap cap \<and> max_free_index (untyped_sz_bits cap) \<le> 2 ^ cap_bits cap \<and> invs s \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cap_table_at (length b) a s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cte_wp_at (\<lambda>cap'. (a, b) \<in> cte_refs cap' (interrupt_irq_node s) \<and> is_cnode_cap cap' \<longrightarrow> (a, b) \<in> cte_refs (max_free_index_update cap) (interrupt_irq_node s) \<and> is_cnode_cap cap) (aa, ba) s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> (if a = aa \<and> b = ba then max_free_index_update cap = NullCap else cte_wp_at (\<lambda>a. a = NullCap) (a, b) s) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} s \<and> is_untyped_cap cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index_update cap = UntypedCap False word1 pageBits (?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt s) = {} \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of word2) = None\<rbrace>
 3. \<And>word1 a b aa ba word2 s. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; (invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False word1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of word2) = None)) s\<rbrakk> \<Longrightarrow> (?P'597 word1 word1 a a b b aa aa ba ba word2 word2 and K (is_aligned word1 page_bits)) s
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; is_aligned word1 page_bits\<rbrakk> \<Longrightarrow> \<lbrace>?P'597 word1 word1 a a b b aa aa ba ba word2 word2\<rbrace> do y <- modify (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits});
modify (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1})
od \<lbrace>\<lambda>y s. \<forall>cap. cte_wp_at ((=) cap) (aa, ba) s \<longrightarrow> word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q s \<and> free_index_of cap \<le> max_free_index (untyped_sz_bits cap) \<and> is_untyped_cap cap \<and> max_free_index (untyped_sz_bits cap) \<le> 2 ^ cap_bits cap \<and> invs s \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cap_table_at (length b) a s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cte_wp_at (\<lambda>cap'. (a, b) \<in> cte_refs cap' (interrupt_irq_node s) \<and> is_cnode_cap cap' \<longrightarrow> (a, b) \<in> cte_refs (max_free_index_update cap) (interrupt_irq_node s) \<and> is_cnode_cap cap) (aa, ba) s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> (if a = aa \<and> b = ba then max_free_index_update cap = NullCap else cte_wp_at (\<lambda>a. a = NullCap) (a, b) s) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} s \<and> is_untyped_cap cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index_update cap = UntypedCap False word1 pageBits (?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt s) = {} \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) s \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) s \<and> invs s \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table s) \<and> asid_table s (asid_high_bits_of word2) = None\<rbrace>
 2. \<And>word1 a b aa ba word2 s. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; (invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False word1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of word2) = None)) s\<rbrakk> \<Longrightarrow> (?P'597 word1 word1 a a b b aa aa ba ba word2 word2 and K (is_aligned word1 page_bits)) s
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; (invs and Q and ct_active and (\<lambda>s. cte_wp_at (\<lambda>c. c = NullCap) (a, b) s \<and> cap_table_at (length b) a s \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) s \<and> (a = aa \<longrightarrow> b \<noteq> ba) \<and> cte_wp_at (\<lambda>cap. \<exists>idx. cap = UntypedCap False word1 pageBits idx) (aa, ba) s \<and> descendants_of (aa, ba) (cdt s) = {} \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> asid_table s (asid_high_bits_of word2) = None)) s\<rbrakk> \<Longrightarrow> ((\<lambda>c. \<forall>cap. cte_wp_at ((=) cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<longrightarrow> word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> free_index_of cap \<le> max_free_index (untyped_sz_bits cap) \<and> is_untyped_cap cap \<and> max_free_index (untyped_sz_bits cap) \<le> 2 ^ cap_bits cap \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> is_aligned word2 local.asid_low_bits \<and> word2 < 2 ^ local.asid_bits \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> cap_table_at (length b) a (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> is_untyped_cap cap \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> cte_wp_at (\<lambda>cap'. (a, b) \<in> cte_refs cap' (interrupt_irq_node (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c))) \<and> is_cnode_cap cap' \<longrightarrow> (a, b) \<in> cte_refs (max_free_index_update cap) (interrupt_irq_node (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c))) \<and> is_cnode_cap cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> (if a = aa \<and> b = ba then max_free_index_update cap = NullCap else cte_wp_at (\<lambda>a. a = NullCap) (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c))) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> is_untyped_cap cap \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> is_untyped_cap cap \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> is_untyped_cap cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index_update cap = UntypedCap False word1 pageBits (?idx605 word1 word1 a a b b aa aa ba ba word2 word2 cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c))) = {} \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> is_untyped_cap cap \<and> cte_wp_at (\<lambda>c. untyped_range c = untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c))) \<and> asid_table (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} c)) (asid_high_bits_of word2) = None) and K (is_aligned word1 page_bits)) s
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; caps_of_state s (a, b) = Some NullCap; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (UntypedCap False word1 pageBits idx); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None\<rbrakk> \<Longrightarrow> (\<forall>cap. (if word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 then None else caps_of_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (aa, ba)) = Some cap \<longrightarrow> word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> free_index_of cap \<le> max_free_index (untyped_sz_bits cap) \<and> is_untyped_cap cap \<and> max_free_index (untyped_sz_bits cap) \<le> 2 ^ cap_bits cap \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_cnode_cap cap \<longrightarrow> (a, b) \<in> cte_refs (max_free_index_update cap) (interrupt_irq_node (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s))) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> (if a = aa \<and> b = ba then max_free_index_update cap = NullCap else cte_wp_at (\<lambda>a. a = NullCap) (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s))) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index_update cap = UntypedCap False word1 pageBits (?idx605 word1 word1 a a b b aa aa ba ba word2 word2 cap) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None) \<and> is_aligned word1 page_bits
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; caps_of_state s (a, b) = Some NullCap; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (UntypedCap False word1 pageBits idx); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (?ptr634 word1 a b aa ba word2 s idx) s
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; caps_of_state s (a, b) = Some NullCap; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (UntypedCap False word1 pageBits idx); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None\<rbrakk> \<Longrightarrow> is_untyped_cap (UntypedCap False word1 pageBits idx)
 3. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; caps_of_state s (a, b) = Some NullCap; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (UntypedCap False word1 pageBits idx); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None\<rbrakk> \<Longrightarrow> descendants_range (UntypedCap False word1 pageBits idx) (?ptr634 word1 a b aa ba word2 s idx) s
 4. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; caps_of_state s (a, b) = Some NullCap; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (UntypedCap False word1 pageBits idx); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; (invs and untyped_children_in_mdb) (detype (untyped_range (UntypedCap False word1 pageBits idx)) (clear_um (untyped_range (UntypedCap False word1 pageBits idx)) s))\<rbrakk> \<Longrightarrow> (\<forall>cap. (if word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 then None else caps_of_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (aa, ba)) = Some cap \<longrightarrow> word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> free_index_of cap \<le> max_free_index (untyped_sz_bits cap) \<and> is_untyped_cap cap \<and> max_free_index (untyped_sz_bits cap) \<le> 2 ^ cap_bits cap \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_cnode_cap cap \<longrightarrow> (a, b) \<in> cte_refs (max_free_index_update cap) (interrupt_irq_node (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s))) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> (if a = aa \<and> b = ba then max_free_index_update cap = NullCap else cte_wp_at (\<lambda>a. a = NullCap) (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s))) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index_update cap = UntypedCap False word1 pageBits (?idx605 word1 word1 a a b b aa aa ba ba word2 word2 cap) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None) \<and> is_aligned word1 page_bits
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; caps_of_state s (a, b) = Some NullCap; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (UntypedCap False word1 pageBits idx); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None\<rbrakk> \<Longrightarrow> descendants_range (UntypedCap False word1 pageBits idx) (aa, ba) s
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; caps_of_state s (a, b) = Some NullCap; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (UntypedCap False word1 pageBits idx); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; (invs and untyped_children_in_mdb) (detype (untyped_range (UntypedCap False word1 pageBits idx)) (clear_um (untyped_range (UntypedCap False word1 pageBits idx)) s))\<rbrakk> \<Longrightarrow> (\<forall>cap. (if word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 then None else caps_of_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (aa, ba)) = Some cap \<longrightarrow> word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> free_index_of cap \<le> max_free_index (untyped_sz_bits cap) \<and> is_untyped_cap cap \<and> max_free_index (untyped_sz_bits cap) \<le> 2 ^ cap_bits cap \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_cnode_cap cap \<longrightarrow> (a, b) \<in> cte_refs (max_free_index_update cap) (interrupt_irq_node (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s))) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> (if a = aa \<and> b = ba then max_free_index_update cap = NullCap else cte_wp_at (\<lambda>a. a = NullCap) (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s))) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index_update cap = UntypedCap False word1 pageBits (?idx605 word1 word1 a a b b aa aa ba ba word2 word2 cap) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None) \<and> is_aligned word1 page_bits
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; caps_of_state s (a, b) = Some NullCap; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (UntypedCap False word1 pageBits idx); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; (invs and untyped_children_in_mdb) (detype (untyped_range (UntypedCap False word1 pageBits idx)) (clear_um (untyped_range (UntypedCap False word1 pageBits idx)) s))\<rbrakk> \<Longrightarrow> (\<forall>cap. (if word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 then None else caps_of_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (aa, ba)) = Some cap \<longrightarrow> word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> free_index_of cap \<le> max_free_index (untyped_sz_bits cap) \<and> is_untyped_cap cap \<and> max_free_index (untyped_sz_bits cap) \<le> 2 ^ cap_bits cap \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_cnode_cap cap \<longrightarrow> (a, b) \<in> cte_refs (max_free_index_update cap) (interrupt_irq_node (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s))) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> (if a = aa \<and> b = ba then max_free_index_update cap = NullCap else cte_wp_at (\<lambda>a. a = NullCap) (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s))) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index_update cap = UntypedCap False word1 pageBits (?idx605 word1 word1 a a b b aa aa ba ba word2 word2 cap) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} \<subseteq> untyped_range cap \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> descendants_range_in (untyped_range cap) (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area (obj_ref_of cap) (cap_bits cap)) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> is_untyped_cap cap \<and> {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} \<subseteq> cap_range cap \<and> up_aligned_area word1 pageBits \<subseteq> cap_range cap \<and> \<not> cap_is_device (max_free_index_update cap) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None) \<and> is_aligned word1 page_bits
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; caps_of_state s (a, b) = Some NullCap; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (UntypedCap False word1 pageBits idx); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) \<and> untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s))\<rbrakk> \<Longrightarrow> (a = aa \<and> b = ba \<longrightarrow> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> word2 && mask local.asid_low_bits \<noteq> 0 \<and> is_aligned word1 page_bits)) \<and> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index pageBits = ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None) \<and> is_aligned word1 page_bits)
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s))\<rbrakk> \<Longrightarrow> (a = aa \<and> b = ba \<longrightarrow> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> word2 && mask local.asid_low_bits \<noteq> 0 \<and> is_aligned word1 page_bits)) \<and> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index pageBits = ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None) \<and> is_aligned word1 page_bits)
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (5 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s))\<rbrakk> \<Longrightarrow> descendants_range_in (?S650 word1 a b aa ba word2 s idx) (aa, ba) s
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s))\<rbrakk> \<Longrightarrow> invs s
 3. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s))\<rbrakk> \<Longrightarrow> ?S650 word1 a b aa ba word2 s idx \<subseteq> untyped_range (UntypedCap False word1 pageBits idx)
 4. \<And>word1 a b aa ba word2 s idx cap. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); UntypedCap False word1 pageBits idx = cap\<rbrakk> \<Longrightarrow> cap \<noteq> NullCap
 5. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); fst (aa, ba) \<notin> ?S650 word1 a b aa ba word2 s idx\<rbrakk> \<Longrightarrow> (a = aa \<and> b = ba \<longrightarrow> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> word2 && mask local.asid_low_bits \<noteq> 0 \<and> is_aligned word1 page_bits)) \<and> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index pageBits = ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None) \<and> is_aligned word1 page_bits)
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s))\<rbrakk> \<Longrightarrow> ?S650 word1 a b aa ba word2 s idx \<subseteq> {word1..word1 + 2 ^ pageBits - 1}
 2. \<And>word1 a b aa ba word2 s idx cap. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); UntypedCap False word1 pageBits idx = cap\<rbrakk> \<Longrightarrow> cap \<noteq> NullCap
 3. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); fst (aa, ba) \<notin> ?S650 word1 a b aa ba word2 s idx\<rbrakk> \<Longrightarrow> (a = aa \<and> b = ba \<longrightarrow> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> word2 && mask local.asid_low_bits \<noteq> 0 \<and> is_aligned word1 page_bits)) \<and> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index pageBits = ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None) \<and> is_aligned word1 page_bits)
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s idx cap. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); UntypedCap False word1 pageBits idx = cap\<rbrakk> \<Longrightarrow> cap \<noteq> NullCap
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); fst (aa, ba) \<notin> {}\<rbrakk> \<Longrightarrow> (a = aa \<and> b = ba \<longrightarrow> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> word2 && mask local.asid_low_bits \<noteq> 0 \<and> is_aligned word1 page_bits)) \<and> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index pageBits = ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None) \<and> is_aligned word1 page_bits)
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); fst (aa, ba) \<notin> {}\<rbrakk> \<Longrightarrow> (a = aa \<and> b = ba \<longrightarrow> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> word2 && mask local.asid_low_bits \<noteq> 0 \<and> is_aligned word1 page_bits)) \<and> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index pageBits = ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None) \<and> is_aligned word1 page_bits)
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); fst (aa, ba) \<notin> {}\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); fst (aa, ba) \<notin> {}; s \<turnstile> UntypedCap False word1 pageBits idx\<rbrakk> \<Longrightarrow> (a = aa \<and> b = ba \<longrightarrow> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> word2 && mask local.asid_low_bits \<noteq> 0 \<and> is_aligned word1 page_bits)) \<and> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index pageBits = ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None) \<and> is_aligned word1 page_bits)
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} s)); fst (aa, ba) \<notin> {}; s \<turnstile> UntypedCap False word1 pageBits idx\<rbrakk> \<Longrightarrow> (a = aa \<and> b = ba \<longrightarrow> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> word2 && mask local.asid_low_bits \<noteq> 0 \<and> is_aligned word1 page_bits)) \<and> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> max_free_index pageBits = ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<longrightarrow> word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> invs (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None) \<and> is_aligned word1 page_bits)
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx\<rbrakk> \<Longrightarrow> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> (b = ba \<and> a = aa \<longrightarrow> (word1 && ~~ mask page_bits \<le> aa \<and> aa \<le> word1 + 2 ^ page_bits - 1 \<longrightarrow> is_aligned word1 page_bits) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> is_aligned word1 page_bits \<and> word2 && mask local.asid_low_bits \<noteq> 0)) \<and> ((word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> is_aligned word1 page_bits \<and> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> max_free_index pageBits = ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> invs (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s))))
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx\<rbrakk> \<Longrightarrow> (word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1) \<longrightarrow> is_aligned word1 page_bits \<and> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> max_free_index pageBits = ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> invs (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)))
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1\<rbrakk> \<Longrightarrow> is_aligned word1 page_bits \<and> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> max_free_index pageBits = ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> invs (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)))
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1\<rbrakk> \<Longrightarrow> is_aligned word1 page_bits \<and> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> max_free_index pageBits = ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> invs (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)))
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1; cap_aligned (UntypedCap False word1 pageBits idx)\<rbrakk> \<Longrightarrow> is_aligned word1 page_bits \<and> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> cap_aligned (ArchObjectCap (ASIDPoolCap word1 word2)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> max_free_index pageBits = ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> invs (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<longrightarrow> (word1 && ~~ mask pageBits) + 2 ^ pageBits - 1 \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<longrightarrow> (word1 && ~~ mask pageBits) + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)))
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> is_aligned word1 page_bits \<and> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> caps_no_overlap word1 pageBits (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> max_free_index pageBits = ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> invs (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)) \<and> (word1 \<le> word1 + (2 ^ pageBits - 1) \<longrightarrow> word1 + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)))
flex-flex pairs:
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> is_aligned word1 page_bits \<and> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> True \<and> max_free_index pageBits = ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> invs (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)) \<and> (word1 \<le> word1 + (2 ^ pageBits - 1) \<longrightarrow> word1 + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)))
flex-flex pairs:
\<lambda>word1 a b aa ba word2 idx. ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 idx. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx)
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1; is_aligned word1 pageBits; pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1..word1 + 2 ^ pageBits - 1} s)\<rbrakk> \<Longrightarrow> is_aligned word1 page_bits \<and> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> True \<and> max_free_index pageBits = ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> invs (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)) \<and> (word1 \<le> word1 + (2 ^ pageBits - 1) \<longrightarrow> word1 + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)))
flex-flex pairs:
\<lambda>word1 a b aa ba word2 idx. ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 idx. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx)
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1; is_aligned word1 pageBits; pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1..word1 + 2 ^ pageBits - 1} s)\<rbrakk> \<Longrightarrow> pageBits \<le> LENGTH(32)
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1; is_aligned word1 pageBits; pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}\<rbrakk> \<Longrightarrow> is_aligned word1 page_bits \<and> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> True \<and> max_free_index pageBits = ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> invs (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)) \<and> (word1 \<le> word1 + (2 ^ pageBits - 1) \<longrightarrow> word1 + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)))
flex-flex pairs:
\<lambda>word1 a b aa ba word2 idx. ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 idx. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx)
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1; is_aligned word1 pageBits; pspace_no_overlap (up_aligned_area word1 pageBits) (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}\<rbrakk> \<Longrightarrow> is_aligned word1 page_bits \<and> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> True \<and> max_free_index pageBits = ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> invs (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)) \<and> (word1 \<le> word1 + (2 ^ pageBits - 1) \<longrightarrow> word1 + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)))
flex-flex pairs:
\<lambda>word1 a b aa ba word2 idx. ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 idx. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx)
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 && ~~ mask page_bits \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ page_bits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}\<rbrakk> \<Longrightarrow> is_aligned word1 page_bits \<and> (word2 && mask local.asid_low_bits = 0 \<longrightarrow> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 && ~~ mask page_bits \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ page_bits - 1) \<and> max_free_index pageBits = ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) \<and> asid_table (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} s)) = {} \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s) \<and> invs (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)) \<and> (word1 \<le> word1 + (2 ^ pageBits - 1) \<longrightarrow> word1 + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1 + word_of_nat k |k. k < 2 ^ page_bits} (detype {word1 && ~~ mask page_bits..word1 + 2 ^ page_bits - 1} s)))
flex-flex pairs:
\<lambda>word1 a b aa ba word2 idx. ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 idx. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx)
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> max_free_index pageBits = ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1..word1 + 2 ^ pageBits - 1} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) \<and> asid_table (clear_um {word1..word1 + 2 ^ pageBits - 1} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) = {} \<and> (word1 \<le> word1 + (2 ^ pageBits - 1) \<longrightarrow> word1 + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s))
flex-flex pairs:
\<lambda>word1 a b aa ba word2 idx. ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 idx. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx)
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (5 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> descendants_range_in (?S713 word1 a b aa ba word2 s idx) (aa, ba) s
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> untyped_children_in_mdb s
 3. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> ?S713 word1 a b aa ba word2 s idx \<subseteq> untyped_range (UntypedCap False word1 pageBits idx)
 4. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> valid_global_refs s
 5. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; fst (a, b) \<notin> ?S713 word1 a b aa ba word2 s idx\<rbrakk> \<Longrightarrow> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> max_free_index pageBits = ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1..word1 + 2 ^ pageBits - 1} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) \<and> asid_table (clear_um {word1..word1 + 2 ^ pageBits - 1} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) = {} \<and> (word1 \<le> word1 + (2 ^ pageBits - 1) \<longrightarrow> word1 + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s))
flex-flex pairs:
\<lambda>word1 a b aa ba word2 idx. ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 idx. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx)
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> untyped_children_in_mdb s
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> ?S713 word1 a b aa ba word2 s idx \<subseteq> untyped_range (UntypedCap False word1 pageBits idx)
 3. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> valid_global_refs s
 4. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; fst (a, b) \<notin> ?S713 word1 a b aa ba word2 s idx\<rbrakk> \<Longrightarrow> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> max_free_index pageBits = ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1..word1 + 2 ^ pageBits - 1} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) \<and> asid_table (clear_um {word1..word1 + 2 ^ pageBits - 1} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) = {} \<and> (word1 \<le> word1 + (2 ^ pageBits - 1) \<longrightarrow> word1 + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s))
flex-flex pairs:
\<lambda>word1 a b aa ba word2 idx. ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 idx. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx)
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> ?S713 word1 a b aa ba word2 s idx \<subseteq> untyped_range (UntypedCap False word1 pageBits idx)
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> valid_global_refs s
 3. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; fst (a, b) \<notin> ?S713 word1 a b aa ba word2 s idx\<rbrakk> \<Longrightarrow> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> max_free_index pageBits = ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1..word1 + 2 ^ pageBits - 1} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) \<and> asid_table (clear_um {word1..word1 + 2 ^ pageBits - 1} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) = {} \<and> (word1 \<le> word1 + (2 ^ pageBits - 1) \<longrightarrow> word1 + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s))
flex-flex pairs:
\<lambda>word1 a b aa ba word2 idx. ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 idx. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx)
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0\<rbrakk> \<Longrightarrow> valid_global_refs s
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; fst (a, b) \<notin> untyped_range (UntypedCap False word1 pageBits idx)\<rbrakk> \<Longrightarrow> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> max_free_index pageBits = ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1..word1 + 2 ^ pageBits - 1} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) \<and> asid_table (clear_um {word1..word1 + 2 ^ pageBits - 1} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) = {} \<and> (word1 \<le> word1 + (2 ^ pageBits - 1) \<longrightarrow> word1 + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s))
flex-flex pairs:
\<lambda>word1 a b aa ba word2 idx. ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 idx. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx)
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; fst (a, b) \<notin> untyped_range (UntypedCap False word1 pageBits idx)\<rbrakk> \<Longrightarrow> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> max_free_index pageBits = ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1..word1 + 2 ^ pageBits - 1} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) \<and> asid_table (clear_um {word1..word1 + 2 ^ pageBits - 1} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) = {} \<and> (word1 \<le> word1 + (2 ^ pageBits - 1) \<longrightarrow> word1 + (2 ^ pageBits - 1) \<le> word1 + 2 ^ pageBits - 1) \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s))
flex-flex pairs:
\<lambda>word1 a b aa ba word2 idx. ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 idx. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx)
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); s \<turnstile> UntypedCap False word1 pageBits idx; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> range_cover word1 pageBits pageBits (Suc 0) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s \<and> free_index_of (UntypedCap False word1 pageBits idx) \<le> max_free_index pageBits \<and> max_free_index pageBits = ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<and> Q (clear_um {word1..word1 + 2 ^ pageBits - 1} s) \<and> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} s) \<and> word1 \<notin> ran (asid_table (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) \<and> asid_table (clear_um {word1..word1 + 2 ^ pageBits - 1} s) (asid_high_bits_of word2) = None \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} s)) = {} \<and> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s))
flex-flex pairs:
\<lambda>word1 a b aa ba word2 idx. ?idxa697 word1 word1 word1 a a a b b b aa aa aa ba ba ba word2 word2 word2 idx (UntypedCap False word1 pageBits idx) \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 idx. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 (UntypedCap False word1 pageBits idx)
\<lambda>word1 a b aa ba word2. ?idx605 word1 word1 a a b b aa aa ba ba word2 word2 \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 ()
\<lambda>word1 a b aa ba word2. ?idx598 word1 word1 a a b b aa aa ba ba word2 word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 ()
\<lambda>word1 a b aa ba word2. ?idx519 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap ()
\<lambda>word1 a b aa ba word2. ?idx518 word1 a b aa ba word2 () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 pcap. ?idx149 word1 a b aa ba word2 () pcap () proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; cap_aligned (UntypedCap False word1 pageBits idx); \<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}; untyped_min_bits \<le> pageBits; idx \<le> 2 ^ pageBits; word1 \<noteq> 0\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>a. a = NullCap) (a, b) s
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} s)
 3. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> word1 \<notin> ran (asid_table s)
 4. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)) proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to is_cnode_cap (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} s)
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> word1 \<notin> ran (asid_table s)
 3. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)) proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> descendants_range (UntypedCap False word1 pageBits idx) (aa, ba) s
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> invs s
 3. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> word1 \<notin> ran (asid_table s)
 4. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)) proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> word1 \<notin> ran (asid_table s)
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)) proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; cap_aligned (UntypedCap False word1 pageBits idx); \<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}; untyped_min_bits \<le> pageBits; idx \<le> 2 ^ pageBits; word1 \<noteq> 0; word1 \<in> ran (asid_table s)\<rbrakk> \<Longrightarrow> False
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)) proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; cap_aligned (UntypedCap False word1 pageBits idx); \<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}; untyped_min_bits \<le> pageBits; idx \<le> 2 ^ pageBits; word1 \<noteq> 0; word1 \<in> ran (asid_table s); valid_arch_state s; valid_arch_state (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s))\<rbrakk> \<Longrightarrow> False
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)) proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; untyped_children_in_mdb (detype {} s); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {} (detype {} s); \<forall>k. \<not> k < 2 ^ pageBits; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; cap_aligned (UntypedCap False word1 pageBits idx); untyped_min_bits \<le> pageBits; idx \<le> 2 ^ pageBits; word1 \<noteq> 0; word1 \<in> ran (asid_table s); \<forall>p\<in>ran (asid_table s). typ_at (AArch AASIDPool) p s; \<forall>p\<in>ran (asid_table s). word1 \<le> p \<longrightarrow> \<not> p \<le> word1 + 2 ^ pageBits - 1; inj_on (asid_table s) (dom (asid_table s)); word1 \<le> arm_global_pd (arch_state s) \<longrightarrow> \<not> arm_global_pd (arch_state s) \<le> word1 + 2 ^ pageBits - 1; valid_global_pts (detype {} s); typ_at (AArch APageDirectory) (arm_global_pd (arch_state s)) s; valid_global_pts s; is_inv (arm_hwasid_table (arch_state s)) (map_option fst \<circ> arm_asid_map (arch_state s))\<rbrakk> \<Longrightarrow> False
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)) proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; untyped_children_in_mdb (detype {} s); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {} (detype {} s); \<forall>k. \<not> k < 2 ^ pageBits; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; cap_aligned (UntypedCap False word1 pageBits idx); untyped_min_bits \<le> pageBits; idx \<le> 2 ^ pageBits; word1 \<noteq> 0; word1 \<in> ran (asid_table s); inj_on (asid_table s) (dom (asid_table s)); word1 \<le> arm_global_pd (arch_state s) \<longrightarrow> \<not> arm_global_pd (arch_state s) \<le> word1 + 2 ^ pageBits - 1; valid_global_pts (detype {} s); typ_at (AArch APageDirectory) (arm_global_pd (arch_state s)) s; valid_global_pts s; is_inv (arm_hwasid_table (arch_state s)) (map_option fst \<circ> arm_asid_map (arch_state s)); typ_at (AArch AASIDPool) word1 s; word1 \<le> word1 \<longrightarrow> \<not> word1 \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> False
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)) proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; untyped_children_in_mdb (detype {} s); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {} (detype {} s); \<forall>k. \<not> k < 2 ^ pageBits; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; cap_aligned (UntypedCap False word1 pageBits idx); untyped_min_bits \<le> pageBits; idx \<le> 2 ^ pageBits; word1 \<noteq> 0; word1 \<in> ran (asid_table s); inj_on (asid_table s) (dom (asid_table s)); word1 \<le> arm_global_pd (arch_state s) \<longrightarrow> \<not> arm_global_pd (arch_state s) \<le> word1 + 2 ^ pageBits - 1; valid_global_pts (detype {} s); typ_at (AArch APageDirectory) (arm_global_pd (arch_state s)) s; valid_global_pts s; is_inv (arm_hwasid_table (arch_state s)) (map_option fst \<circ> arm_asid_map (arch_state s)); typ_at (AArch AASIDPool) word1 s; \<not> word1 \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> False
 2. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)) proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); cap_aligned (UntypedCap False word1 pageBits idx) \<and> (\<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}) \<and> untyped_min_bits \<le> pageBits \<and> idx \<le> 2 ^ pageBits \<and> word1 \<noteq> 0; word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref (ArchObjectCap (ASIDPoolCap word1 word2)) {(a, b)} (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)) proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx ab bb. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) NullCap) (a, b) s; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; cap_aligned (UntypedCap False word1 pageBits idx); \<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}; untyped_min_bits \<le> pageBits; idx \<le> 2 ^ pageBits; word1 \<noteq> 0; ab = a \<longrightarrow> bb \<noteq> b; cte_wp_at (\<lambda>c. obj_refs c = {word1} \<and> table_cap_ref c \<noteq> table_cap_ref (ArchObjectCap (ASIDPoolCap word1 word2))) (ab, bb) s\<rbrakk> \<Longrightarrow> word1 \<le> ab \<and> ab \<le> word1 + 2 ^ pageBits - 1 proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx ab bb. \<lbrakk>aci = MakePool word1 (a, b) (aa, ba) word2; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; cte_wp_at ((=) (UntypedCap False word1 pageBits idx)) (aa, ba) s; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; cap_aligned (UntypedCap False word1 pageBits idx); \<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}; untyped_min_bits \<le> pageBits; idx \<le> 2 ^ pageBits; word1 \<noteq> 0; ab = a \<longrightarrow> bb \<noteq> b; cte_wp_at (\<lambda>c. obj_refs c = {word1} \<and> table_cap_ref c \<noteq> table_cap_ref (ArchObjectCap (ASIDPoolCap word1 word2))) (ab, bb) s\<rbrakk> \<Longrightarrow> word1 \<le> ab \<and> ab \<le> word1 + 2 ^ pageBits - 1 proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s idx ab bb cap'. \<lbrakk>MakePool word1 (a, b) (aa, ba) word2 = aci; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; cap_aligned (UntypedCap False word1 pageBits idx); \<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}; untyped_min_bits \<le> pageBits; idx \<le> 2 ^ pageBits; word1 \<noteq> 0; ab = a \<longrightarrow> bb \<noteq> b; cte_wp_at (\<lambda>c. obj_refs c = {word1} \<and> table_cap_ref c \<noteq> table_cap_ref (ArchObjectCap (ASIDPoolCap word1 word2))) (ab, bb) s; cte_wp_at ((=) cap') (ab, bb) s; obj_refs cap' = {word1} \<and> table_cap_ref cap' \<noteq> table_cap_ref (ArchObjectCap (ASIDPoolCap word1 word2))\<rbrakk> \<Longrightarrow> obj_refs cap' \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {}
 2. \<And>word1 a b aa ba word2 s idx ab bb. \<lbrakk>MakePool word1 (a, b) (aa, ba) word2 = aci; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; cap_aligned (UntypedCap False word1 pageBits idx); \<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}; untyped_min_bits \<le> pageBits; idx \<le> 2 ^ pageBits; word1 \<noteq> 0; ab = a \<longrightarrow> bb \<noteq> b; cte_wp_at (\<lambda>c. obj_refs c = {word1} \<and> table_cap_ref c \<noteq> table_cap_ref (ArchObjectCap (ASIDPoolCap word1 word2))) (ab, bb) s; (ab, bb) \<in> descendants_of (aa, ba) (cdt s)\<rbrakk> \<Longrightarrow> word1 \<le> ab \<and> ab \<le> word1 + 2 ^ pageBits - 1
 3. \<And>word1 a b aa ba word2 s idx ab bb. \<lbrakk>MakePool word1 (a, b) (aa, ba) word2 = aci; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; cap_aligned (UntypedCap False word1 pageBits idx); \<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}; untyped_min_bits \<le> pageBits; idx \<le> 2 ^ pageBits; word1 \<noteq> 0; ab = a \<longrightarrow> bb \<noteq> b; cte_wp_at (\<lambda>c. obj_refs c = {word1} \<and> table_cap_ref c \<noteq> table_cap_ref (ArchObjectCap (ASIDPoolCap word1 word2))) (ab, bb) s\<rbrakk> \<Longrightarrow> untyped_children_in_mdb s proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s idx ab bb. \<lbrakk>MakePool word1 (a, b) (aa, ba) word2 = aci; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; cap_aligned (UntypedCap False word1 pageBits idx); \<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}; untyped_min_bits \<le> pageBits; idx \<le> 2 ^ pageBits; word1 \<noteq> 0; ab = a \<longrightarrow> bb \<noteq> b; cte_wp_at (\<lambda>c. obj_refs c = {word1} \<and> table_cap_ref c \<noteq> table_cap_ref (ArchObjectCap (ASIDPoolCap word1 word2))) (ab, bb) s; (ab, bb) \<in> descendants_of (aa, ba) (cdt s)\<rbrakk> \<Longrightarrow> word1 \<le> ab \<and> ab \<le> word1 + 2 ^ pageBits - 1
 2. \<And>word1 a b aa ba word2 s idx ab bb. \<lbrakk>MakePool word1 (a, b) (aa, ba) word2 = aci; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; cap_aligned (UntypedCap False word1 pageBits idx); \<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}; untyped_min_bits \<le> pageBits; idx \<le> 2 ^ pageBits; word1 \<noteq> 0; ab = a \<longrightarrow> bb \<noteq> b; cte_wp_at (\<lambda>c. obj_refs c = {word1} \<and> table_cap_ref c \<noteq> table_cap_ref (ArchObjectCap (ASIDPoolCap word1 word2))) (ab, bb) s\<rbrakk> \<Longrightarrow> untyped_children_in_mdb s proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s idx ab bb. \<lbrakk>MakePool word1 (a, b) (aa, ba) word2 = aci; invs s; Q s; ct_active s; cap_table_at (length b) a s; ex_cte_cap_wp_to is_cnode_cap (a, b) s; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; invs (machine_state_update (underlying_memory_update (\<lambda>m p. if word1 \<le> p \<and> p \<le> word1 + 2 ^ pageBits - 1 then 0 else m p)) (detype {word1..word1 + 2 ^ pageBits - 1} s)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} s); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; is_aligned word1 pageBits; pspace_no_overlap {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} s); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; word2 && mask local.asid_low_bits = 0; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; cap_aligned (UntypedCap False word1 pageBits idx); \<forall>p obj. kheap s p = Some obj \<longrightarrow> obj_range p obj \<inter> {word1..word1 + 2 ^ pageBits - 1} \<noteq> {} \<longrightarrow> obj_range p obj \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> (if idx < 2 ^ pageBits then {word1 + word_of_nat idx..word1 + 2 ^ pageBits - 1} else {}) \<inter> obj_range p obj = {}; untyped_min_bits \<le> pageBits; idx \<le> 2 ^ pageBits; word1 \<noteq> 0; ab = a \<longrightarrow> bb \<noteq> b; cte_wp_at (\<lambda>c. obj_refs c = {word1} \<and> table_cap_ref c \<noteq> table_cap_ref (ArchObjectCap (ASIDPoolCap word1 word2))) (ab, bb) s\<rbrakk> \<Longrightarrow> untyped_children_in_mdb s proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrace>invs and Q and ct_active and valid_aci aci\<rbrace> perform_asid_control_invocation aci \<lbrace>\<lambda>y s. invs s \<and> Q s\<rbrace>

goal:
No subgoals!