theory ArchFinalise_AI

lemma arch_finalise_cap_replaceable[wp]:
  notes strg = tcb_cap_valid_imp_NullCap
               obj_at_not_live_valid_arch_cap_strg[where cap=cap]
  notes simps = replaceable_def and_not_not_or_imp
                vs_lookup_pages_eq_at[THEN fun_cong, symmetric]
                vs_lookup_pages_eq_ap[THEN fun_cong, symmetric]
                is_cap_simps vs_cap_ref_def
                no_cap_to_obj_with_diff_ref_Null o_def
  notes wps = hoare_drop_imp[where R="%_. is_final_cap' cap" for cap]
              unmap_page_table_unmapped3 valid_cap_typ
  shows
    "\<lbrace>\<lambda>s. s \<turnstile> cap.ArchObjectCap cap \<and>
          x = is_final_cap' (cap.ArchObjectCap cap) s \<and>
          pspace_aligned s \<and> valid_vspace_objs s \<and> valid_objs s \<and>
          valid_asid_table (arm_asid_table (arch_state s)) s\<rbrace>
     arch_finalise_cap cap x
   \<lbrace>\<lambda>rv s. replaceable s sl (fst rv) (cap.ArchObjectCap cap)\<rbrace>" apply (simp add: arch_finalise_cap_def) apply (rule hoare_pre) apply (simp add: simps split: option.splits vmpage_size.splits) apply (wp wps
          | strengthen strg
          | simp add: simps reachable_pg_cap_def
          | wpc)+ 
     (* unmap_page case is a bit unpleasant *)
      apply (strengthen cases_conj_strg[where P="\<not> is_final_cap' cap s" for cap s, simplified]) apply (rule hoare_post_imp, clarsimp split: vmpage_size.split, assumption) apply simp apply (wp hoare_vcg_disj_lift hoare_vcg_all_lift hoare_vcg_const_imp_lift
               unmap_page_tcb_cap_valid unmap_page_page_unmapped
                   unmap_page_section_unmapped)[1] apply (wp wps
           | strengthen strg imp_and_strg tcb_cap_valid_imp_NullCap
           | simp add: simps is_master_reply_cap_def reachable_pg_cap_def
           | wpc)+ apply (auto simp: valid_cap_def obj_at_def simps is_master_reply_cap_def
                    a_type_def data_at_def
             elim!: tcb_cap_valid_imp_NullCap[rule_format, rotated]
             split: cap.splits arch_cap.splits vmpage_size.splits)[1] done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. s \<turnstile> ArchObjectCap cap \<and> x = is_final_cap' (ArchObjectCap cap) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s\<rbrace> arch_finalise_cap cap x \<lbrace>\<lambda>rv s. replaceable s sl (fst rv) (ArchObjectCap cap)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. s \<turnstile> ArchObjectCap cap \<and> x = is_final_cap' (ArchObjectCap cap) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s\<rbrace> case cap of ASIDPoolCap ptr b \<Rightarrow> case x of True \<Rightarrow> do delete_asid_pool b ptr;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) | ASIDControlCap \<Rightarrow> return (NullCap, NullCap) | PageCap x ptr xa s None \<Rightarrow> return (NullCap, NullCap) | PageCap x ptr xa s (Some (a, v)) \<Rightarrow> do unmap_page s a v ptr;
return (NullCap, NullCap)
od | PageTableCap ptr None \<Rightarrow> return (NullCap, NullCap) | PageTableCap ptr (Some (a, v)) \<Rightarrow> case x of True \<Rightarrow> do unmap_page_table a v ptr;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) | PageDirectoryCap ptr None \<Rightarrow> return (NullCap, NullCap) | PageDirectoryCap ptr (Some a) \<Rightarrow> case x of True \<Rightarrow> do delete_asid a ptr;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>rv s. replaceable s sl (fst rv) (ArchObjectCap cap)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q\<rbrace> case cap of ASIDPoolCap ptr b \<Rightarrow> case x of True \<Rightarrow> do delete_asid_pool b ptr;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) | ASIDControlCap \<Rightarrow> return (NullCap, NullCap) | PageCap x ptr xa s None \<Rightarrow> return (NullCap, NullCap) | PageCap x ptr xa s (Some (a, v)) \<Rightarrow> do unmap_page s a v ptr;
return (NullCap, NullCap)
od | PageTableCap ptr None \<Rightarrow> return (NullCap, NullCap) | PageTableCap ptr (Some (a, v)) \<Rightarrow> case x of True \<Rightarrow> do unmap_page_table a v ptr;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) | PageDirectoryCap ptr None \<Rightarrow> return (NullCap, NullCap) | PageDirectoryCap ptr (Some a) \<Rightarrow> case x of True \<Rightarrow> do delete_asid a ptr;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>rv s. replaceable s sl (fst rv) (ArchObjectCap cap)\<rbrace>
 2. \<And>s. s \<turnstile> ArchObjectCap cap \<and> x = is_final_cap' (ArchObjectCap cap) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s \<Longrightarrow> ?Q s proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q\<rbrace> case cap of ASIDPoolCap ptr b \<Rightarrow> case x of True \<Rightarrow> do delete_asid_pool b ptr;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) | ASIDControlCap \<Rightarrow> return (NullCap, NullCap) | PageCap x ptr xa s None \<Rightarrow> return (NullCap, NullCap) | PageCap x ptr xa s (Some (a, v)) \<Rightarrow> do unmap_page s a v ptr;
return (NullCap, NullCap)
od | PageTableCap ptr None \<Rightarrow> return (NullCap, NullCap) | PageTableCap ptr (Some (a, v)) \<Rightarrow> case x of True \<Rightarrow> do unmap_page_table a v ptr;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) | PageDirectoryCap ptr None \<Rightarrow> return (NullCap, NullCap) | PageDirectoryCap ptr (Some a) \<Rightarrow> case x of True \<Rightarrow> do delete_asid a ptr;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>rv s. ArchObjectCap cap = fst rv \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst rv = NullCap \<and> \<not> reachable_pg_cap (ArchObjectCap cap) s \<or> is_final_cap' (ArchObjectCap cap) s \<and> (\<forall>p\<in>set_option (aobj_ref cap) - zobj_refs (fst rv). obj_at (\<lambda>x. \<not> live x) p s) \<and> gen_obj_refs (fst rv) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst rv \<noteq> NullCap \<longrightarrow> cap_range (fst rv) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst rv) sl s) \<and> (\<forall>dev r bits f. fst rv \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst rv \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst rv \<noteq> ReplyCap x False R) \<and> fst rv \<noteq> IRQControlCap \<and> (fst rv \<noteq> NullCap \<longrightarrow> cap_class (fst rv) = acap_class cap \<and> cap_is_device (fst rv) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst rv of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst rv) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst rv) {sl} s \<and> ((\<exists>p asid. fst rv = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst rv) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst rv). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst rv = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst rv) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst rv). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst rv = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst rv) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst rv)) \<and> ((\<exists>p asid. fst rv = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst rv) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst rv)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst rv) \<and> ((\<exists>p asid. fst rv = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst rv) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst rv = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst rv = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst rv) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst rv)) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst rv) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst rv)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst rv) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst rv = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst rv) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst rv)\<rbrace>
 2. \<And>s. s \<turnstile> ArchObjectCap cap \<and> x = is_final_cap' (ArchObjectCap cap) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s \<Longrightarrow> ?Q s proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x2 x1 x2a. \<lbrakk>cap = PageCap x31 x32 x33 x34 (Some (x1, x2a)); x35 = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R139 x31 x32 x33 x34 (Some (x1, x2a)) (x1, x2a) x1 x2a\<rbrace> unmap_page x34 x1 x2a x32 \<lbrace>\<lambda>r s. \<not> is_final_cap' (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x1, x2a)))) s \<and> ((\<forall>dev. x31 = (\<not> dev)) \<or> (\<forall>vref. (case x34 of ARMSection \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, x32) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x1, x2a)))) s \<and> s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x1, x2a))) \<and> (\<forall>vref. (case x34 of ARMSection \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, x32) \<notin> vs_lookup_pages s)\<rbrace>
 2. \<And>x41 x42. cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>?R55 x41 x42\<rbrace> case x42 of None \<Rightarrow> return (NullCap, NullCap) | Some (a, v) \<Rightarrow> case x of True \<Rightarrow> do unmap_page_table a v x41;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>r s. ArchObjectCap cap = fst r \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst r = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst r)) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst r) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_range (fst r) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst r) sl s) \<and> (\<forall>dev ra bits f. fst r \<noteq> UntypedCap dev ra bits f) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x False R) \<and> fst r \<noteq> IRQControlCap \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_class (fst r) = acap_class cap \<and> cap_is_device (fst r) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst r of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst r) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst r) {sl} s \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst r)\<rbrace>
 3. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R56 x51 x52\<rbrace> case x52 of None \<Rightarrow> return (NullCap, NullCap) | Some a \<Rightarrow> case x of True \<Rightarrow> do delete_asid a x51;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>r s. ArchObjectCap cap = fst r \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst r = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst r)) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst r) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_range (fst r) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst r) sl s) \<and> (\<forall>dev ra bits f. fst r \<noteq> UntypedCap dev ra bits f) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x False R) \<and> fst r \<noteq> IRQControlCap \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_class (fst r) = acap_class cap \<and> cap_is_device (fst r) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst r of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst r) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst r) {sl} s \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst r)\<rbrace>
 4. \<And>s. s \<turnstile> ArchObjectCap cap \<and> x = is_final_cap' (ArchObjectCap cap) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s \<Longrightarrow> (\<forall>xa xb. cap = ASIDPoolCap xa xb \<longrightarrow> (x = True \<longrightarrow> s \<turnstile> ArchObjectCap (ASIDPoolCap xa xb) \<and> \<not> is_master_reply_cap (ArchObjectCap (ASIDPoolCap xa xb)) \<and> True) \<and> (x = False \<longrightarrow> ArchObjectCap (ASIDPoolCap xa xb) = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap (ASIDPoolCap xa xb)) s \<and> fst (NullCap, NullCap) = NullCap \<or> is_final_cap' (ArchObjectCap (ASIDPoolCap xa xb)) s \<and> (xa \<notin> zobj_refs (fst (NullCap, NullCap)) \<longrightarrow> s \<turnstile> ArchObjectCap (ASIDPoolCap xa xb)) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap (ASIDPoolCap xa xb)) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap (ASIDPoolCap xa xb))) \<and> (tcb_cap_valid (ArchObjectCap (ASIDPoolCap xa xb)) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = PhysicalClass \<and> \<not> cap_is_device (fst (NullCap, NullCap))) \<and> ((case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of xb)) None] \<and> obj_refs (fst (NullCap, NullCap)) = {xa} \<or> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of xb)) None], xa) \<notin> vs_lookup s) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap)))) \<and> (cap = ASIDControlCap \<longrightarrow> ArchObjectCap cap = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst (NullCap, NullCap) = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst (NullCap, NullCap))) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = acap_class cap \<and> cap_is_device (fst (NullCap, NullCap)) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst (NullCap, NullCap)) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap))) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> ArchObjectCap (PageCap x xa xb xc xd) = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap (PageCap x xa xb xc xd)) s \<and> fst (NullCap, NullCap) = NullCap \<and> ((\<forall>dev. x = (\<not> dev)) \<or> (\<forall>vref. (case xc of ARMSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, xa) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap (PageCap x xa xb xc xd)) s \<and> (xa \<notin> zobj_refs (fst (NullCap, NullCap)) \<longrightarrow> s \<turnstile> ArchObjectCap (PageCap x xa xb xc xd)) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap (PageCap x xa xb xc xd)) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap (PageCap x xa xb xc xd))) \<and> (tcb_cap_valid (ArchObjectCap (PageCap x xa xb xc xd)) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = PhysicalClass \<and> cap_is_device (fst (NullCap, NullCap)) = x) \<and> (\<forall>vref. (case xc of ARMSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst (NullCap, NullCap)) = {xa} \<or> (vref, xa) \<notin> vs_lookup_pages s) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap))) \<and> (\<forall>xe. xd = Some xe \<longrightarrow> (\<forall>xf xg. xe = (xf, xg) \<longrightarrow> ?R139 x xa xb xc xd xe xf xg s))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> ?R55 x xa s) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R56 x xa s) proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x2 x1 x2a. \<lbrakk>cap = PageCap x31 x32 x33 x34 (Some (x1, x2a)); x35 = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R139 x31 x32 x33 x34 (Some (x1, x2a)) (x1, x2a) x1 x2a\<rbrace> unmap_page x34 x1 x2a x32 \<lbrace>\<lambda>r s. \<not> is_final_cap' (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x1, x2a)))) s \<and> ((\<forall>dev. x31 = (\<not> dev)) \<or> (\<forall>vref. (case x34 of ARMSection \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, x32) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x1, x2a)))) s \<and> s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x1, x2a))) \<and> (\<forall>vref. (case x34 of ARMSection \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, x32) \<notin> vs_lookup_pages s)\<rbrace>
 2. \<And>x41 x42. cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>?R55 x41 x42\<rbrace> case x42 of None \<Rightarrow> return (NullCap, NullCap) | Some (a, v) \<Rightarrow> case x of True \<Rightarrow> do unmap_page_table a v x41;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>r s. ArchObjectCap cap = fst r \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst r = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst r)) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst r) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_range (fst r) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst r) sl s) \<and> (\<forall>dev ra bits f. fst r \<noteq> UntypedCap dev ra bits f) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x False R) \<and> fst r \<noteq> IRQControlCap \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_class (fst r) = acap_class cap \<and> cap_is_device (fst r) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst r of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst r) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst r) {sl} s \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst r)\<rbrace>
 3. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R56 x51 x52\<rbrace> case x52 of None \<Rightarrow> return (NullCap, NullCap) | Some a \<Rightarrow> case x of True \<Rightarrow> do delete_asid a x51;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>r s. ArchObjectCap cap = fst r \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst r = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst r)) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst r) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_range (fst r) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst r) sl s) \<and> (\<forall>dev ra bits f. fst r \<noteq> UntypedCap dev ra bits f) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x False R) \<and> fst r \<noteq> IRQControlCap \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_class (fst r) = acap_class cap \<and> cap_is_device (fst r) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst r of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst r) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst r) {sl} s \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst r)\<rbrace>
 4. \<And>s. s \<turnstile> ArchObjectCap cap \<and> x = is_final_cap' (ArchObjectCap cap) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s \<Longrightarrow> (\<forall>xa xb. cap = ASIDPoolCap xa xb \<longrightarrow> (x = True \<longrightarrow> s \<turnstile> ArchObjectCap (ASIDPoolCap xa xb) \<and> \<not> is_master_reply_cap (ArchObjectCap (ASIDPoolCap xa xb)) \<and> True) \<and> (x = False \<longrightarrow> ArchObjectCap (ASIDPoolCap xa xb) = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap (ASIDPoolCap xa xb)) s \<and> fst (NullCap, NullCap) = NullCap \<or> is_final_cap' (ArchObjectCap (ASIDPoolCap xa xb)) s \<and> (xa \<notin> zobj_refs (fst (NullCap, NullCap)) \<longrightarrow> s \<turnstile> ArchObjectCap (ASIDPoolCap xa xb)) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap (ASIDPoolCap xa xb)) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap (ASIDPoolCap xa xb))) \<and> (tcb_cap_valid (ArchObjectCap (ASIDPoolCap xa xb)) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = PhysicalClass \<and> \<not> cap_is_device (fst (NullCap, NullCap))) \<and> ((case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of xb)) None] \<and> obj_refs (fst (NullCap, NullCap)) = {xa} \<or> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of xb)) None], xa) \<notin> vs_lookup s) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap)))) \<and> (cap = ASIDControlCap \<longrightarrow> ArchObjectCap cap = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst (NullCap, NullCap) = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst (NullCap, NullCap))) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = acap_class cap \<and> cap_is_device (fst (NullCap, NullCap)) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst (NullCap, NullCap)) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap))) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> ArchObjectCap (PageCap x xa xb xc xd) = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap (PageCap x xa xb xc xd)) s \<and> fst (NullCap, NullCap) = NullCap \<and> ((\<forall>dev. x = (\<not> dev)) \<or> (\<forall>vref. (case xc of ARMSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, xa) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap (PageCap x xa xb xc xd)) s \<and> (xa \<notin> zobj_refs (fst (NullCap, NullCap)) \<longrightarrow> s \<turnstile> ArchObjectCap (PageCap x xa xb xc xd)) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap (PageCap x xa xb xc xd)) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap (PageCap x xa xb xc xd))) \<and> (tcb_cap_valid (ArchObjectCap (PageCap x xa xb xc xd)) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = PhysicalClass \<and> cap_is_device (fst (NullCap, NullCap)) = x) \<and> (\<forall>vref. (case xc of ARMSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst (NullCap, NullCap)) = {xa} \<or> (vref, xa) \<notin> vs_lookup_pages s) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap))) \<and> (\<forall>xe. xd = Some xe \<longrightarrow> (\<forall>xf xg. xe = (xf, xg) \<longrightarrow> ?R139 x xa xb xc xd xe xf xg s))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> ?R55 x xa s) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R56 x xa s) proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x2 x1 x2a. \<lbrakk>cap = PageCap x31 x32 x33 x34 (Some (x1, x2a)); x35 = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R139 x31 x32 x33 x34 (Some (x1, x2a)) (x1, x2a) x1 x2a\<rbrace> unmap_page x34 x1 x2a x32 \<lbrace>\<lambda>r s. ((\<forall>dev. x31 = (\<not> dev)) \<or> (\<forall>vref. (case x34 of ARMSection \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, x32) \<notin> vs_lookup_pages s)) \<and> s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x1, x2a))) \<and> (\<forall>vref. (case x34 of ARMSection \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case x35 of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, x32) \<notin> vs_lookup_pages s)\<rbrace>
 2. \<And>x41 x42. cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>?R55 x41 x42\<rbrace> case x42 of None \<Rightarrow> return (NullCap, NullCap) | Some (a, v) \<Rightarrow> case x of True \<Rightarrow> do unmap_page_table a v x41;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>r s. ArchObjectCap cap = fst r \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst r = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst r)) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst r) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_range (fst r) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst r) sl s) \<and> (\<forall>dev ra bits f. fst r \<noteq> UntypedCap dev ra bits f) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x False R) \<and> fst r \<noteq> IRQControlCap \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_class (fst r) = acap_class cap \<and> cap_is_device (fst r) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst r of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst r) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst r) {sl} s \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst r)\<rbrace>
 3. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R56 x51 x52\<rbrace> case x52 of None \<Rightarrow> return (NullCap, NullCap) | Some a \<Rightarrow> case x of True \<Rightarrow> do delete_asid a x51;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>r s. ArchObjectCap cap = fst r \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst r = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst r)) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst r) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_range (fst r) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst r) sl s) \<and> (\<forall>dev ra bits f. fst r \<noteq> UntypedCap dev ra bits f) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x False R) \<and> fst r \<noteq> IRQControlCap \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_class (fst r) = acap_class cap \<and> cap_is_device (fst r) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst r of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst r) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst r) {sl} s \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst r)\<rbrace>
 4. \<And>s. s \<turnstile> ArchObjectCap cap \<and> x = is_final_cap' (ArchObjectCap cap) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s \<Longrightarrow> (\<forall>xa xb. cap = ASIDPoolCap xa xb \<longrightarrow> (x = True \<longrightarrow> s \<turnstile> ArchObjectCap (ASIDPoolCap xa xb) \<and> \<not> is_master_reply_cap (ArchObjectCap (ASIDPoolCap xa xb)) \<and> True) \<and> (x = False \<longrightarrow> ArchObjectCap (ASIDPoolCap xa xb) = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap (ASIDPoolCap xa xb)) s \<and> fst (NullCap, NullCap) = NullCap \<or> is_final_cap' (ArchObjectCap (ASIDPoolCap xa xb)) s \<and> (xa \<notin> zobj_refs (fst (NullCap, NullCap)) \<longrightarrow> s \<turnstile> ArchObjectCap (ASIDPoolCap xa xb)) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap (ASIDPoolCap xa xb)) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap (ASIDPoolCap xa xb))) \<and> (tcb_cap_valid (ArchObjectCap (ASIDPoolCap xa xb)) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = PhysicalClass \<and> \<not> cap_is_device (fst (NullCap, NullCap))) \<and> ((case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of xb)) None] \<and> obj_refs (fst (NullCap, NullCap)) = {xa} \<or> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of xb)) None], xa) \<notin> vs_lookup s) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap)))) \<and> (cap = ASIDControlCap \<longrightarrow> ArchObjectCap cap = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst (NullCap, NullCap) = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst (NullCap, NullCap))) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = acap_class cap \<and> cap_is_device (fst (NullCap, NullCap)) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst (NullCap, NullCap)) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap))) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> ArchObjectCap (PageCap x xa xb xc xd) = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap (PageCap x xa xb xc xd)) s \<and> fst (NullCap, NullCap) = NullCap \<and> ((\<forall>dev. x = (\<not> dev)) \<or> (\<forall>vref. (case xc of ARMSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, xa) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap (PageCap x xa xb xc xd)) s \<and> (xa \<notin> zobj_refs (fst (NullCap, NullCap)) \<longrightarrow> s \<turnstile> ArchObjectCap (PageCap x xa xb xc xd)) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap (PageCap x xa xb xc xd)) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap (PageCap x xa xb xc xd))) \<and> (tcb_cap_valid (ArchObjectCap (PageCap x xa xb xc xd)) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = PhysicalClass \<and> cap_is_device (fst (NullCap, NullCap)) = x) \<and> (\<forall>vref. (case xc of ARMSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst (NullCap, NullCap)) = {xa} \<or> (vref, xa) \<notin> vs_lookup_pages s) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap))) \<and> (\<forall>xe. xd = Some xe \<longrightarrow> (\<forall>xf xg. xe = (xf, xg) \<longrightarrow> ?R139 x xa xb xc xd xe xf xg s))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> ?R55 x xa s) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R56 x xa s) proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x2 x1 x2a. \<lbrakk>cap = PageCap x31 x32 x33 x34 (Some (x1, x2a)); x35 = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R139 x31 x32 x33 x34 (Some (x1, x2a)) (x1, x2a) x1 x2a\<rbrace> unmap_page x34 x1 x2a x32 \<lbrace>\<lambda>a b. (x34 = ARMSmallPage \<longrightarrow> ((\<forall>dev. x31 = (\<not> dev)) \<or> ([VSRef ((x2a >> 12) && mask 8) (Some APageTable), VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b) \<and> b \<turnstile> ArchObjectCap (PageCap x31 x32 x33 ARMSmallPage x35) \<and> ([VSRef ((x2a >> 12) && mask 8) (Some APageTable), VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b) \<and> (x34 = ARMLargePage \<longrightarrow> ((\<forall>dev. x31 = (\<not> dev)) \<or> ([VSRef ((x2a >> 12) && mask 8) (Some APageTable), VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b) \<and> b \<turnstile> ArchObjectCap (PageCap x31 x32 x33 ARMLargePage x35) \<and> ([VSRef ((x2a >> 12) && mask 8) (Some APageTable), VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b) \<and> (x34 = ARMSection \<longrightarrow> ((\<forall>dev. x31 = (\<not> dev)) \<or> ([VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b) \<and> b \<turnstile> ArchObjectCap (PageCap x31 x32 x33 ARMSection x35) \<and> ([VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b) \<and> (x34 = ARMSuperSection \<longrightarrow> ((\<forall>dev. x31 = (\<not> dev)) \<or> ([VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b) \<and> b \<turnstile> ArchObjectCap (PageCap x31 x32 x33 ARMSuperSection x35) \<and> ([VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b)\<rbrace>
 2. \<And>x41 x42. cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>?R55 x41 x42\<rbrace> case x42 of None \<Rightarrow> return (NullCap, NullCap) | Some (a, v) \<Rightarrow> case x of True \<Rightarrow> do unmap_page_table a v x41;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>r s. ArchObjectCap cap = fst r \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst r = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst r)) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst r) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_range (fst r) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst r) sl s) \<and> (\<forall>dev ra bits f. fst r \<noteq> UntypedCap dev ra bits f) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x False R) \<and> fst r \<noteq> IRQControlCap \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_class (fst r) = acap_class cap \<and> cap_is_device (fst r) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst r of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst r) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst r) {sl} s \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst r)\<rbrace>
 3. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R56 x51 x52\<rbrace> case x52 of None \<Rightarrow> return (NullCap, NullCap) | Some a \<Rightarrow> case x of True \<Rightarrow> do delete_asid a x51;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>r s. ArchObjectCap cap = fst r \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst r = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst r)) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst r) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_range (fst r) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst r) sl s) \<and> (\<forall>dev ra bits f. fst r \<noteq> UntypedCap dev ra bits f) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x False R) \<and> fst r \<noteq> IRQControlCap \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_class (fst r) = acap_class cap \<and> cap_is_device (fst r) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst r of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst r) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst r) {sl} s \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst r)\<rbrace>
 4. \<And>s. s \<turnstile> ArchObjectCap cap \<and> x = is_final_cap' (ArchObjectCap cap) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s \<Longrightarrow> (\<forall>xa xb. cap = ASIDPoolCap xa xb \<longrightarrow> (x = True \<longrightarrow> s \<turnstile> ArchObjectCap (ASIDPoolCap xa xb) \<and> \<not> is_master_reply_cap (ArchObjectCap (ASIDPoolCap xa xb)) \<and> True) \<and> (x = False \<longrightarrow> ArchObjectCap (ASIDPoolCap xa xb) = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap (ASIDPoolCap xa xb)) s \<and> fst (NullCap, NullCap) = NullCap \<or> is_final_cap' (ArchObjectCap (ASIDPoolCap xa xb)) s \<and> (xa \<notin> zobj_refs (fst (NullCap, NullCap)) \<longrightarrow> s \<turnstile> ArchObjectCap (ASIDPoolCap xa xb)) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap (ASIDPoolCap xa xb)) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap (ASIDPoolCap xa xb))) \<and> (tcb_cap_valid (ArchObjectCap (ASIDPoolCap xa xb)) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = PhysicalClass \<and> \<not> cap_is_device (fst (NullCap, NullCap))) \<and> ((case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of xb)) None] \<and> obj_refs (fst (NullCap, NullCap)) = {xa} \<or> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of xb)) None], xa) \<notin> vs_lookup s) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap)))) \<and> (cap = ASIDControlCap \<longrightarrow> ArchObjectCap cap = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst (NullCap, NullCap) = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst (NullCap, NullCap))) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = acap_class cap \<and> cap_is_device (fst (NullCap, NullCap)) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst (NullCap, NullCap)) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap))) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> ArchObjectCap (PageCap x xa xb xc xd) = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap (PageCap x xa xb xc xd)) s \<and> fst (NullCap, NullCap) = NullCap \<and> ((\<forall>dev. x = (\<not> dev)) \<or> (\<forall>vref. (case xc of ARMSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, xa) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap (PageCap x xa xb xc xd)) s \<and> (xa \<notin> zobj_refs (fst (NullCap, NullCap)) \<longrightarrow> s \<turnstile> ArchObjectCap (PageCap x xa xb xc xd)) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap (PageCap x xa xb xc xd)) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap (PageCap x xa xb xc xd))) \<and> (tcb_cap_valid (ArchObjectCap (PageCap x xa xb xc xd)) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = PhysicalClass \<and> cap_is_device (fst (NullCap, NullCap)) = x) \<and> (\<forall>vref. (case xc of ARMSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst (NullCap, NullCap)) = {xa} \<or> (vref, xa) \<notin> vs_lookup_pages s) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap))) \<and> (\<forall>xe. xd = Some xe \<longrightarrow> (\<forall>xf xg. xe = (xf, xg) \<longrightarrow> ?R139 x xa xb xc xd xe xf xg s))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> ?R55 x xa s) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R56 x xa s) proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x2 x1 x2a. \<lbrakk>cap = PageCap x31 x32 x33 x34 (Some (x1, x2a)); x35 = Some (x1, x2a); x2 = (x1, x2a)\<rbrakk> \<Longrightarrow> \<lbrace>?R139 x31 x32 x33 x34 (Some (x1, x2a)) (x1, x2a) x1 x2a\<rbrace> unmap_page x34 x1 x2a x32 \<lbrace>\<lambda>a b. (x34 = ARMSmallPage \<longrightarrow> ((\<forall>dev. x31 = (\<not> dev)) \<or> ([VSRef ((x2a >> 12) && mask 8) (Some APageTable), VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b) \<and> b \<turnstile> ArchObjectCap (PageCap x31 x32 x33 ARMSmallPage (Some (x1, x2a))) \<and> ([VSRef ((x2a >> 12) && mask 8) (Some APageTable), VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b) \<and> (x34 = ARMLargePage \<longrightarrow> ((\<forall>dev. x31 = (\<not> dev)) \<or> ([VSRef ((x2a >> 12) && mask 8) (Some APageTable), VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b) \<and> b \<turnstile> ArchObjectCap (PageCap x31 x32 x33 ARMLargePage (Some (x1, x2a))) \<and> ([VSRef ((x2a >> 12) && mask 8) (Some APageTable), VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b) \<and> (x34 = ARMSection \<longrightarrow> ((\<forall>dev. x31 = (\<not> dev)) \<or> ([VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b) \<and> b \<turnstile> ArchObjectCap (PageCap x31 x32 x33 ARMSection (Some (x1, x2a))) \<and> ([VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b) \<and> (x34 = ARMSuperSection \<longrightarrow> ((\<forall>dev. x31 = (\<not> dev)) \<or> ([VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b) \<and> b \<turnstile> ArchObjectCap (PageCap x31 x32 x33 ARMSuperSection (Some (x1, x2a))) \<and> ([VSRef (x2a >> 20) (Some APageDirectory), VSRef (x1 && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x1)) None], x32) \<notin> vs_lookup_pages b)\<rbrace>
 2. \<And>x41 x42. cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>?R55 x41 x42\<rbrace> case x42 of None \<Rightarrow> return (NullCap, NullCap) | Some (a, v) \<Rightarrow> case x of True \<Rightarrow> do unmap_page_table a v x41;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>r s. ArchObjectCap cap = fst r \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst r = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst r)) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst r) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_range (fst r) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst r) sl s) \<and> (\<forall>dev ra bits f. fst r \<noteq> UntypedCap dev ra bits f) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x False R) \<and> fst r \<noteq> IRQControlCap \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_class (fst r) = acap_class cap \<and> cap_is_device (fst r) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst r of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst r) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst r) {sl} s \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst r)\<rbrace>
 3. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R56 x51 x52\<rbrace> case x52 of None \<Rightarrow> return (NullCap, NullCap) | Some a \<Rightarrow> case x of True \<Rightarrow> do delete_asid a x51;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>r s. ArchObjectCap cap = fst r \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst r = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst r)) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst r) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_range (fst r) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst r) sl s) \<and> (\<forall>dev ra bits f. fst r \<noteq> UntypedCap dev ra bits f) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x False R) \<and> fst r \<noteq> IRQControlCap \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_class (fst r) = acap_class cap \<and> cap_is_device (fst r) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst r of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst r) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst r) {sl} s \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst r)\<rbrace>
 4. \<And>s. s \<turnstile> ArchObjectCap cap \<and> x = is_final_cap' (ArchObjectCap cap) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s \<Longrightarrow> (\<forall>xa xb. cap = ASIDPoolCap xa xb \<longrightarrow> (x = True \<longrightarrow> s \<turnstile> ArchObjectCap (ASIDPoolCap xa xb) \<and> \<not> is_master_reply_cap (ArchObjectCap (ASIDPoolCap xa xb)) \<and> True) \<and> (x = False \<longrightarrow> ArchObjectCap (ASIDPoolCap xa xb) = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap (ASIDPoolCap xa xb)) s \<and> fst (NullCap, NullCap) = NullCap \<or> is_final_cap' (ArchObjectCap (ASIDPoolCap xa xb)) s \<and> (xa \<notin> zobj_refs (fst (NullCap, NullCap)) \<longrightarrow> s \<turnstile> ArchObjectCap (ASIDPoolCap xa xb)) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap (ASIDPoolCap xa xb)) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap (ASIDPoolCap xa xb))) \<and> (tcb_cap_valid (ArchObjectCap (ASIDPoolCap xa xb)) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = PhysicalClass \<and> \<not> cap_is_device (fst (NullCap, NullCap))) \<and> ((case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of xb)) None] \<and> obj_refs (fst (NullCap, NullCap)) = {xa} \<or> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of xb)) None], xa) \<notin> vs_lookup s) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap)))) \<and> (cap = ASIDControlCap \<longrightarrow> ArchObjectCap cap = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst (NullCap, NullCap) = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst (NullCap, NullCap))) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = acap_class cap \<and> cap_is_device (fst (NullCap, NullCap)) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst (NullCap, NullCap)) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap))) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> ArchObjectCap (PageCap x xa xb xc xd) = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap (PageCap x xa xb xc xd)) s \<and> fst (NullCap, NullCap) = NullCap \<and> ((\<forall>dev. x = (\<not> dev)) \<or> (\<forall>vref. (case xc of ARMSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, xa) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap (PageCap x xa xb xc xd)) s \<and> (xa \<notin> zobj_refs (fst (NullCap, NullCap)) \<longrightarrow> s \<turnstile> ArchObjectCap (PageCap x xa xb xc xd)) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap (PageCap x xa xb xc xd)) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap (PageCap x xa xb xc xd))) \<and> (tcb_cap_valid (ArchObjectCap (PageCap x xa xb xc xd)) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = PhysicalClass \<and> cap_is_device (fst (NullCap, NullCap)) = x) \<and> (\<forall>vref. (case xc of ARMSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst (NullCap, NullCap)) = {xa} \<or> (vref, xa) \<notin> vs_lookup_pages s) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap))) \<and> (\<forall>xe. xd = Some xe \<longrightarrow> (\<forall>xf xg. xe = (xf, xg) \<longrightarrow> ?R139 x xa xb xc xd xe xf xg s))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> ?R55 x xa s) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R56 x xa s) proof (prove)
goal (3 subgoals):
 1. \<And>x41 x42. cap = PageTableCap x41 x42 \<Longrightarrow> \<lbrace>?R55 x41 x42\<rbrace> case x42 of None \<Rightarrow> return (NullCap, NullCap) | Some (a, v) \<Rightarrow> case x of True \<Rightarrow> do unmap_page_table a v x41;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>r s. ArchObjectCap cap = fst r \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst r = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst r)) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst r) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_range (fst r) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst r) sl s) \<and> (\<forall>dev ra bits f. fst r \<noteq> UntypedCap dev ra bits f) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x False R) \<and> fst r \<noteq> IRQControlCap \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_class (fst r) = acap_class cap \<and> cap_is_device (fst r) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst r of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst r) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst r) {sl} s \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst r)\<rbrace>
 2. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R56 x51 x52\<rbrace> case x52 of None \<Rightarrow> return (NullCap, NullCap) | Some a \<Rightarrow> case x of True \<Rightarrow> do delete_asid a x51;
return (NullCap, NullCap)
od | False \<Rightarrow> return (NullCap, NullCap) \<lbrace>\<lambda>r s. ArchObjectCap cap = fst r \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst r = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst r)) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst r) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_range (fst r) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst r) sl s) \<and> (\<forall>dev ra bits f. fst r \<noteq> UntypedCap dev ra bits f) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst r \<noteq> ReplyCap x False R) \<and> fst r \<noteq> IRQControlCap \<and> (fst r \<noteq> NullCap \<longrightarrow> cap_class (fst r) = acap_class cap \<and> cap_is_device (fst r) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst r of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst r) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst r) {sl} s \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst r) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst r). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst r = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst r) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst r)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst r) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst r = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst r) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst r)\<rbrace>
 3. \<And>s. s \<turnstile> ArchObjectCap cap \<and> x = is_final_cap' (ArchObjectCap cap) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s \<Longrightarrow> (\<forall>xa xb. cap = ASIDPoolCap xa xb \<longrightarrow> (x = True \<longrightarrow> s \<turnstile> ArchObjectCap (ASIDPoolCap xa xb) \<and> \<not> is_master_reply_cap (ArchObjectCap (ASIDPoolCap xa xb)) \<and> True) \<and> (x = False \<longrightarrow> ArchObjectCap (ASIDPoolCap xa xb) = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap (ASIDPoolCap xa xb)) s \<and> fst (NullCap, NullCap) = NullCap \<or> is_final_cap' (ArchObjectCap (ASIDPoolCap xa xb)) s \<and> (xa \<notin> zobj_refs (fst (NullCap, NullCap)) \<longrightarrow> s \<turnstile> ArchObjectCap (ASIDPoolCap xa xb)) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap (ASIDPoolCap xa xb)) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap (ASIDPoolCap xa xb))) \<and> (tcb_cap_valid (ArchObjectCap (ASIDPoolCap xa xb)) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = PhysicalClass \<and> \<not> cap_is_device (fst (NullCap, NullCap))) \<and> ((case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of xb)) None] \<and> obj_refs (fst (NullCap, NullCap)) = {xa} \<or> ([VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of xb)) None], xa) \<notin> vs_lookup s) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap)))) \<and> (cap = ASIDControlCap \<longrightarrow> ArchObjectCap cap = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap cap) s \<and> fst (NullCap, NullCap) = NullCap \<and> ((\<forall>dev p R sz m. cap \<noteq> PageCap dev p R sz m) \<or> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, the (aobj_ref cap)) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap cap) s \<and> ((\<exists>x. aobj_ref cap = Some x \<and> x \<notin> zobj_refs (fst (NullCap, NullCap))) \<longrightarrow> s \<turnstile> ArchObjectCap cap) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap cap) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap cap)) \<and> (tcb_cap_valid (ArchObjectCap cap) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = acap_class cap \<and> cap_is_device (fst (NullCap, NullCap)) = arch_cap_is_device cap) \<and> (\<forall>vref. (case cap of ASIDPoolCap obj_ref asid \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ASIDControlCap \<Rightarrow> None | PageCap dev obj_ref rights ARMSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights ARMSuperSection None \<Rightarrow> None | PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageCap dev obj_ref rights _ None \<Rightarrow> None | PageCap dev obj_ref rights _ (Some (asid, vptr)) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageTableCap obj_ref None \<Rightarrow> None | PageTableCap obj_ref (Some (asid, vptr)) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | PageDirectoryCap obj_ref None \<Rightarrow> None | PageDirectoryCap obj_ref (Some asid) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst (NullCap, NullCap)) = set_option (aobj_ref cap) \<or> (\<forall>oref\<in>set_option (aobj_ref cap). (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap = PageTableCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<and> ((\<exists>p asid. cap = PageDirectoryCap p asid) \<longrightarrow> (cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> cap_asid (ArchObjectCap cap) = None) \<longrightarrow> set_option (aobj_ref cap) \<noteq> obj_refs (fst (NullCap, NullCap))) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap))) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> ArchObjectCap (PageCap x xa xb xc xd) = fst (NullCap, NullCap) \<or> \<not> is_final_cap' (ArchObjectCap (PageCap x xa xb xc xd)) s \<and> fst (NullCap, NullCap) = NullCap \<and> ((\<forall>dev. x = (\<not> dev)) \<or> (\<forall>vref. (case xc of ARMSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, xa) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap (PageCap x xa xb xc xd)) s \<and> (xa \<notin> zobj_refs (fst (NullCap, NullCap)) \<longrightarrow> s \<turnstile> ArchObjectCap (PageCap x xa xb xc xd)) \<and> gen_obj_refs (fst (NullCap, NullCap)) \<subseteq> gen_obj_refs (ArchObjectCap (PageCap x xa xb xc xd)) \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_range (fst (NullCap, NullCap)) = cap_range (ArchObjectCap (PageCap x xa xb xc xd))) \<and> (tcb_cap_valid (ArchObjectCap (PageCap x xa xb xc xd)) sl s \<longrightarrow> tcb_cap_valid (fst (NullCap, NullCap)) sl s) \<and> (\<forall>dev r bits f. fst (NullCap, NullCap) \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x True R) \<and> (\<forall>x R. fst (NullCap, NullCap) \<noteq> ReplyCap x False R) \<and> fst (NullCap, NullCap) \<noteq> IRQControlCap \<and> (fst (NullCap, NullCap) \<noteq> NullCap \<longrightarrow> cap_class (fst (NullCap, NullCap)) = PhysicalClass \<and> cap_is_device (fst (NullCap, NullCap)) = x) \<and> (\<forall>vref. (case xc of ARMSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (case fst (NullCap, NullCap) of ArchObjectCap (ASIDPoolCap obj_ref asid) \<Rightarrow> Some [VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap ASIDControlCap \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights ARMSuperSection (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageCap dev obj_ref rights _ None) \<Rightarrow> None | ArchObjectCap (PageCap dev obj_ref rights _ (Some (asid, vptr))) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageTableCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageTableCap obj_ref (Some (asid, vptr))) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ArchObjectCap (PageDirectoryCap obj_ref None) \<Rightarrow> None | ArchObjectCap (PageDirectoryCap obj_ref (Some asid)) \<Rightarrow> Some [VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> None) = Some vref \<and> obj_refs (fst (NullCap, NullCap)) = {xa} \<or> (vref, xa) \<notin> vs_lookup_pages s) \<and> no_cap_to_obj_with_diff_ref (fst (NullCap, NullCap)) {sl} s \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid (fst (NullCap, NullCap)) = None \<longrightarrow> (\<forall>r\<in>obj_refs (fst (NullCap, NullCap)). obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> ((\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (\<forall>a b. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs (fst (NullCap, NullCap)) \<and> ((\<exists>p asid. cap' = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. fst (NullCap, NullCap) = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. cap' = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid (fst (NullCap, NullCap)) = None \<or> cap_asid cap' = None)) (a, b) s \<longrightarrow> (a, b) = sl)) \<and> \<not> is_ap_cap (fst (NullCap, NullCap))) \<and> (\<forall>xe. xd = Some xe \<longrightarrow> (\<forall>xf xg. xe = (xf, xg) \<longrightarrow> (xc = ARMSmallPage \<longrightarrow> ((\<forall>xa. x = (\<not> xa)) \<or> (pspace_aligned and valid_objs and valid_vspace_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and data_at xc xa and K (xa = xa) and K (xc = ARMSmallPage \<or> xc = ARMLargePage)) s) \<and> s \<turnstile> ArchObjectCap (PageCap x xa xb ARMSmallPage xd) \<and> (pspace_aligned and valid_objs and valid_vspace_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and data_at xc xa and K (xa = xa) and K (xc = ARMSmallPage \<or> xc = ARMLargePage)) s) \<and> (xc = ARMLargePage \<longrightarrow> ((\<forall>xa. x = (\<not> xa)) \<or> (pspace_aligned and valid_objs and valid_vspace_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and data_at xc xa and K (xa = xa) and K (xc = ARMSmallPage \<or> xc = ARMLargePage)) s) \<and> s \<turnstile> ArchObjectCap (PageCap x xa xb ARMLargePage xd) \<and> (pspace_aligned and valid_objs and valid_vspace_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and data_at xc xa and K (xa = xa) and K (xc = ARMSmallPage \<or> xc = ARMLargePage)) s) \<and> (xc = ARMSection \<longrightarrow> ((\<forall>xa. x = (\<not> xa)) \<or> (pspace_aligned and valid_objs and valid_vspace_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and data_at xc xa and K (xa = xa) and K (xc = ARMSection \<or> xc = ARMSuperSection)) s) \<and> s \<turnstile> ArchObjectCap (PageCap x xa xb ARMSection xd) \<and> (pspace_aligned and valid_objs and valid_vspace_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and data_at xc xa and K (xa = xa) and K (xc = ARMSection \<or> xc = ARMSuperSection)) s) \<and> (xc = ARMSuperSection \<longrightarrow> ((\<forall>xa. x = (\<not> xa)) \<or> (pspace_aligned and valid_objs and valid_vspace_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and data_at xc xa and K (xa = xa) and K (xc = ARMSection \<or> xc = ARMSuperSection)) s) \<and> s \<turnstile> ArchObjectCap (PageCap x xa xb ARMSuperSection xd) \<and> (pspace_aligned and valid_objs and valid_vspace_objs and (\<lambda>s. valid_asid_table (asid_table s) s) and data_at xc xa and K (xa = xa) and K (xc = ARMSection \<or> xc = ARMSuperSection)) s)))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> ?R55 x xa s) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R56 x xa s) proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<turnstile> ArchObjectCap cap \<and> x = is_final_cap' (ArchObjectCap cap) s \<and> pspace_aligned s \<and> valid_vspace_objs s \<and> valid_objs s \<and> valid_asid_table (asid_table s) s \<Longrightarrow> (\<forall>x xa. cap = ASIDPoolCap x xa \<longrightarrow> is_final_cap' (ArchObjectCap (ASIDPoolCap x xa)) s \<longrightarrow> s \<turnstile> ArchObjectCap (ASIDPoolCap x xa)) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (xd = None \<longrightarrow> \<not> is_final_cap' (ArchObjectCap (PageCap x xa xb xc None)) s \<and> ((\<forall>dev. x = (\<not> dev)) \<or> (\<forall>vref. (case xc of ARMSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, xa) \<notin> vs_lookup_pages s)) \<or> is_final_cap' (ArchObjectCap (PageCap x xa xb xc None)) s \<and> s \<turnstile> ArchObjectCap (PageCap x xa xb xc None) \<and> (\<forall>vref. (case xc of ARMSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | ARMSuperSection \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None] | _ \<Rightarrow> case xd of None \<Rightarrow> None | Some (asid, vptr) \<Rightarrow> Some [VSRef ((vptr >> 12) && mask 8) (Some APageTable), VSRef (vptr >> 20) (Some APageDirectory), VSRef (asid && mask local.asid_low_bits) (Some AASIDPool), VSRef (UCAST(7 \<rightarrow> 32) (asid_high_bits_of asid)) None]) = Some vref \<longrightarrow> (vref, xa) \<notin> vs_lookup_pages s)) \<and> (\<forall>a b. xd = Some (a, b) \<longrightarrow> (xc = ARMSmallPage \<longrightarrow> ((\<forall>xa. x = (\<not> xa)) \<or> data_at ARMSmallPage xa s) \<and> s \<turnstile> ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (a, b))) \<and> data_at ARMSmallPage xa s) \<and> (xc = ARMLargePage \<longrightarrow> ((\<forall>xa. x = (\<not> xa)) \<or> data_at ARMLargePage xa s) \<and> s \<turnstile> ArchObjectCap (PageCap x xa xb ARMLargePage (Some (a, b))) \<and> data_at ARMLargePage xa s) \<and> (xc = ARMSection \<longrightarrow> ((\<forall>xa. x = (\<not> xa)) \<or> data_at ARMSection xa s) \<and> s \<turnstile> ArchObjectCap (PageCap x xa xb ARMSection (Some (a, b))) \<and> data_at ARMSection xa s) \<and> (xc = ARMSuperSection \<longrightarrow> ((\<forall>xa. x = (\<not> xa)) \<or> data_at ARMSuperSection xa s) \<and> s \<turnstile> ArchObjectCap (PageCap x xa xb ARMSuperSection (Some (a, b))) \<and> data_at ARMSuperSection xa s))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> (xa = None \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap x None)) s \<longrightarrow> s \<turnstile> ArchObjectCap (PageTableCap x None)) \<and> (\<forall>a b. xa = Some (a, b) \<longrightarrow> is_final_cap' (ArchObjectCap (PageTableCap x (Some (a, b)))) s \<longrightarrow> s \<turnstile> ArchObjectCap (PageTableCap x (Some (a, b))) \<and> typ_at (AArch APageTable) x s)) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> (xa = None \<longrightarrow> is_final_cap' (ArchObjectCap (PageDirectoryCap x None)) s \<longrightarrow> s \<turnstile> ArchObjectCap (PageDirectoryCap x None)) \<and> (\<forall>xb. xa = Some xb \<longrightarrow> is_final_cap' (ArchObjectCap (PageDirectoryCap x (Some xb))) s \<longrightarrow> s \<turnstile> ArchObjectCap (PageDirectoryCap x (Some xb)))) proof (prove)
goal:
No subgoals!