theory ArchAcc_R

lemma get_master_pde_corres [@lift_corres_args, corres]:
  "corres pde_relation' (pde_at p)
     (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and
      pspace_aligned' and pspace_distinct')
     (get_master_pde p) (getObject p)" proof - have [simp]: "max pd_bits 6 = pd_bits" by (simp add:pd_bits_def pageBits_def) have expand: "p && ~~ mask pd_bits = (p && ~~ mask 6) && ~~ mask pd_bits" by (simp add: and_not_mask_twice) have [simp]: "is_aligned (p && ~~ mask 6 >> 2) 4" apply (rule is_aligned_shiftr) apply (simp add:is_aligned_neg_mask) done show ?thesis apply (simp add: getObject_def get_pde_def get_pd_def  get_object_def
      split_def bind_assoc pde_relation_aligned_def get_master_pde_def) apply (rule corres_no_failI) apply (rule no_fail_pre, wp) apply (clarsimp simp: ko_wp_at'_def typ_at'_def lookupAround2_known1) apply (case_tac ko, simp_all)[1] apply (rename_tac arch_kernel_object) apply (case_tac arch_kernel_object, simp_all add: projectKOs)[1] apply (clarsimp simp: objBits_def cong: option.case_cong) apply (erule (1) ps_clear_lookupAround2) apply simp apply (erule is_aligned_no_overflow) apply (simp add: objBits_simps archObjSize_def word_bits_def) apply simp apply (clarsimp simp: in_monad loadObject_default_def
      projectKOs and_not_mask_twice) apply (simp add: bind_assoc exec_gets) apply (clarsimp simp: pde_at_def obj_at_def) apply (clarsimp split:ARM_A.pde.splits) apply (intro conjI impI)
  \<comment> \<open>master_pde = InvaliatePTE\<close> apply (clarsimp simp add: a_type_def return_def get_pd_def
                  bind_def get_pde_def get_object_def gets_def get_def
                  split: if_split_asm Structures_A.kernel_object.splits arch_kernel_obj.splits) apply (clarsimp simp:typ_at'_def ko_wp_at'_def) apply (clarsimp simp: in_magnitude_check objBits_simps archObjSize_def pageBits_def pdeBits_def) apply (clarsimp simp:state_relation_def) apply (frule_tac x = "(ucast (p && mask pd_bits >> 2))"
                     in pde_relation_alignedD) apply assumption apply (simp add:mask_pd_bits_inner_beauty) apply (clarsimp simp: pde_relation_aligned_def
                      split: if_splits ARM_H.pde.splits) apply (drule_tac p' = "p && ~~ mask 6" in valid_duplicates'_D[rotated]) apply (simp add:is_aligned_neg_mask is_aligned_weaken[where y = 2]) apply (clarsimp simp: vs_ptr_align_def and_not_mask_twice) apply simp apply (frule_tac x = "(ucast ((p && ~~ mask 6) && mask pd_bits >> 2))"
                     in pde_relation_alignedD) apply assumption apply (simp add:expand) apply (subst mask_pd_bits_inner_beauty) apply (simp add:is_aligned_neg_mask) apply assumption apply (clarsimp simp: pde_relation_aligned_def
                  is_aligned_mask[where 'a=32, symmetric])

  \<comment> \<open>master_pde = PageTablePDE\<close> apply (clarsimp simp add: a_type_def return_def get_pd_def
        bind_def get_pde_def get_object_def gets_def get_def
        split: if_split_asm Structures_A.kernel_object.splits arch_kernel_obj.splits) apply (clarsimp simp:typ_at'_def ko_wp_at'_def) apply (clarsimp simp: in_magnitude_check objBits_simps archObjSize_def pageBits_def pdeBits_def) apply (clarsimp simp:state_relation_def) apply (frule_tac x = "(ucast (p && mask pd_bits >> 2))" in pde_relation_alignedD) apply assumption apply (simp add:mask_pd_bits_inner_beauty) apply (clarsimp simp:pde_relation_aligned_def
        split:if_splits ARM_H.pde.splits) apply (drule_tac p' = "p && ~~ mask 6" in valid_duplicates'_D[rotated]) apply (simp add:is_aligned_neg_mask is_aligned_weaken[where y = 2]) apply (clarsimp simp: vs_ptr_align_def) apply (simp add:and_not_mask_twice) apply (drule_tac x = "(ucast ((p && ~~ mask 6) && mask pd_bits >> 2))" in pde_relation_alignedD) apply assumption apply (simp add:expand) apply (subst mask_pd_bits_inner_beauty) apply (simp add:is_aligned_neg_mask) apply assumption apply (clarsimp simp:pde_relation_aligned_def
         is_aligned_mask[symmetric])
  \<comment> \<open>master_pde = SectionPDE\<close> apply (clarsimp simp add: a_type_def return_def get_pd_def
       bind_def get_pde_def get_object_def gets_def get_def
       split: if_split_asm Structures_A.kernel_object.splits arch_kernel_obj.splits) apply (clarsimp simp:typ_at'_def ko_wp_at'_def) apply (clarsimp simp: in_magnitude_check objBits_simps archObjSize_def pageBits_def pdeBits_def) apply (clarsimp simp:state_relation_def) apply (frule_tac x = "(ucast (p && mask pd_bits >> 2))" in pde_relation_alignedD) apply assumption apply (simp add:mask_pd_bits_inner_beauty) apply (clarsimp simp:pde_relation_aligned_def
       split:if_splits ARM_H.pde.splits) apply (drule_tac p' = "p && ~~ mask 6" in valid_duplicates'_D[rotated]) apply (simp add:is_aligned_neg_mask is_aligned_weaken[where y = 2]) apply (clarsimp simp: vs_ptr_align_def) apply (simp add:and_not_mask_twice) apply (drule_tac x = "(ucast ((p && ~~ mask 6) && mask pd_bits >> 2))" in pde_relation_alignedD) apply assumption apply (simp add: expand) apply (subst mask_pd_bits_inner_beauty) apply (simp add:is_aligned_neg_mask) apply assumption apply (clarsimp simp:pde_relation_aligned_def
         is_aligned_mask[symmetric])
  \<comment> \<open>master_pde = SuperSectionPDE\<close> apply (clarsimp simp add: a_type_def return_def get_pd_def
      bind_def get_pde_def get_object_def gets_def get_def
      split: if_split_asm Structures_A.kernel_object.splits arch_kernel_obj.splits) apply (clarsimp simp:typ_at'_def ko_wp_at'_def) apply (clarsimp simp: in_magnitude_check objBits_simps archObjSize_def pageBits_def pdeBits_def) apply (clarsimp simp:state_relation_def) apply (drule_tac s = a and s' = b and p = "p && ~~ mask 6"
      in aligned_distinct_relation_pde_atI'[rotated -1]) apply (clarsimp simp:pde_at_def obj_at_def
         and_not_mask_twice a_type_simps is_aligned_neg_mask) apply simp apply simp apply (clarsimp simp:typ_at'_def ko_wp_at'_def) apply (case_tac ko; simp) apply (rename_tac arch_kernel_object) apply (case_tac arch_kernel_object; simp add: projectKOs) apply clarsimp apply (frule_tac x = "(ucast ((p && ~~ mask 6 )&& mask pd_bits >> 2))" in pde_relation_alignedD) apply assumption apply (simp add: expand) apply (subst mask_pd_bits_inner_beauty) apply (simp add:is_aligned_neg_mask) apply assumption apply (rename_tac pde) apply (case_tac pde) apply (simp add: pde_relation_aligned_def
                      is_aligned_mask[where 'a=32, symmetric])+ apply clarsimp apply (drule_tac p = "p && ~~ mask 6" and p' = p  in valid_duplicates'_D) apply assumption apply simp apply (clarsimp simp: vs_ptr_align_def and_not_mask_twice) apply simp done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. corres pde_relation' (pde_at p) (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (get_master_pde p) (getObject p) proof (state)
goal (1 subgoal):
 1. corres pde_relation' (pde_at p) (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (get_master_pde p) (getObject p) proof (prove)
goal (1 subgoal):
 1. max pd_bits 6 = pd_bits proof (state)
this:
max pd_bits 6 = pd_bits

goal (1 subgoal):
 1. corres pde_relation' (pde_at p) (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (get_master_pde p) (getObject p) proof (prove)
goal (1 subgoal):
 1. p && ~~ mask pd_bits = (p && ~~ mask 6) && ~~ mask pd_bits proof (state)
this:
p && ~~ mask pd_bits = (p && ~~ mask 6) && ~~ mask pd_bits

goal (1 subgoal):
 1. corres pde_relation' (pde_at p) (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (get_master_pde p) (getObject p) proof (prove)
goal (1 subgoal):
 1. is_aligned (p && ~~ mask 6 >> 2) 4 proof (prove)
goal (1 subgoal):
 1. is_aligned (p && ~~ mask 6) (4 + 2) proof (prove)
goal:
No subgoals! proof (state)
this:
is_aligned (p && ~~ mask 6 >> 2) 4

goal (1 subgoal):
 1. corres pde_relation' (pde_at p) (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (get_master_pde p) (getObject p) proof (prove)
goal (1 subgoal):
 1. corres pde_relation' (pde_at p) (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (get_master_pde p) (getObject p) proof (prove)
goal (1 subgoal):
 1. corres pde_relation' (pde_at p) (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pd_bits) = Some y);
pd <- case the (x ((p && ~~ mask 6) && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) (do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) proof (prove)
goal (2 subgoals):
 1. True \<Longrightarrow> no_fail (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od)
 2. \<forall>(s, s')\<in>state_relation. pde_at p s \<and> (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pd_bits) = Some y);
pd <- case the (x ((p && ~~ mask 6) && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) s). (t, t') \<in> state_relation \<and> pde_relation' r r') proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>True; (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. ((\<lambda>_. fst (lookupAround2 p (ksPSpace s)) \<noteq> None) and (\<lambda>sa. fst (lookupAround2 p (ksPSpace s)) \<noteq> None \<longrightarrow> (\<exists>obj. projectKO_opt (snd (the (fst (lookupAround2 p (ksPSpace s))))) = Some obj \<and> is_aligned p (objBits obj) \<and> fst (the (fst (lookupAround2 p (ksPSpace s)))) = p \<and> (case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBits obj \<le> x - p)))) s)) s
 2. \<forall>(s, s')\<in>state_relation. pde_at p s \<and> (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pd_bits) = Some y);
pd <- case the (x ((p && ~~ mask 6) && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) s). (t, t') \<in> state_relation \<and> pde_relation' r r') proof (prove)
goal (2 subgoals):
 1. \<And>s ko. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some ko; pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO ko); koTypeOf ko = ArchT PDET; ps_clear p (objBitsKO ko) s\<rbrakk> \<Longrightarrow> \<exists>obj. projectKO_opt ko = Some obj \<and> is_aligned p (objBits obj) \<and> (case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBits obj \<le> x - p)
 2. \<forall>(s, s')\<in>state_relation. pde_at p s \<and> (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pd_bits) = Some y);
pd <- case the (x ((p && ~~ mask 6) && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) s). (t, t') \<in> state_relation \<and> pde_relation' r r') proof (prove)
goal (2 subgoals):
 1. \<And>s ko x8. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch x8); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch x8)); archTypeOf x8 = PDET; ps_clear p (objBitsKO (KOArch x8)) s; ko = KOArch x8\<rbrakk> \<Longrightarrow> \<exists>obj. projectKO_opt (KOArch x8) = Some obj \<and> is_aligned p (objBits obj) \<and> (case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBits obj \<le> x - p)
 2. \<forall>(s, s')\<in>state_relation. pde_at p s \<and> (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pd_bits) = Some y);
pd <- case the (x ((p && ~~ mask 6) && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) s). (t, t') \<in> state_relation \<and> pde_relation' r r') proof (prove)
goal (2 subgoals):
 1. \<And>s ko arch_kernel_object. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch arch_kernel_object); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch arch_kernel_object)); archTypeOf arch_kernel_object = PDET; ps_clear p (objBitsKO (KOArch arch_kernel_object)) s; ko = KOArch arch_kernel_object\<rbrakk> \<Longrightarrow> \<exists>obj. projectKO_opt (KOArch arch_kernel_object) = Some obj \<and> is_aligned p (objBits obj) \<and> (case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBits obj \<le> x - p)
 2. \<forall>(s, s')\<in>state_relation. pde_at p s \<and> (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pd_bits) = Some y);
pd <- case the (x ((p && ~~ mask 6) && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) s). (t, t') \<in> state_relation \<and> pde_relation' r r') proof (prove)
goal (2 subgoals):
 1. \<And>s ko arch_kernel_object x3. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPDE x3)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPDE x3))); ps_clear p (objBitsKO (KOArch (KOPDE x3))) s; ko = KOArch (KOPDE x3); arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> is_aligned p (objBits x3) \<and> (case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBits x3 \<le> x - p)
 2. \<forall>(s, s')\<in>state_relation. pde_at p s \<and> (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pd_bits) = Some y);
pd <- case the (x ((p && ~~ mask 6) && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) s). (t, t') \<in> state_relation \<and> pde_relation' r r') proof (prove)
goal (2 subgoals):
 1. \<And>s x3. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPDE x3)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPDE x3))); ps_clear p (objBitsKO (KOArch (KOPDE x3))) s\<rbrakk> \<Longrightarrow> case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBitsKO (KOArch (KOPDE x3)) \<le> x - p
 2. \<forall>(s, s')\<in>state_relation. pde_at p s \<and> (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pd_bits) = Some y);
pd <- case the (x ((p && ~~ mask 6) && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) s). (t, t') \<in> state_relation \<and> pde_relation' r r') proof (prove)
goal (4 subgoals):
 1. \<And>s x3. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPDE x3)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPDE x3)))\<rbrakk> \<Longrightarrow> p \<le> p
 2. \<And>s x3. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPDE x3)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPDE x3)))\<rbrakk> \<Longrightarrow> p \<le> p + 2 ^ objBitsKO (KOArch (KOPDE x3)) - 1
 3. \<And>s x3. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPDE x3)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPDE x3))); fst (lookupAround2 p (ksPSpace s)) = Some (p, KOArch (KOPDE x3)); case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBitsKO (KOArch (KOPDE x3)) \<le> x - p\<rbrakk> \<Longrightarrow> case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBitsKO (KOArch (KOPDE x3)) \<le> x - p
 4. \<forall>(s, s')\<in>state_relation. pde_at p s \<and> (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pd_bits) = Some y);
pd <- case the (x ((p && ~~ mask 6) && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) s). (t, t') \<in> state_relation \<and> pde_relation' r r') proof (prove)
goal (3 subgoals):
 1. \<And>s x3. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPDE x3)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPDE x3)))\<rbrakk> \<Longrightarrow> p \<le> p + 2 ^ objBitsKO (KOArch (KOPDE x3)) - 1
 2. \<And>s x3. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPDE x3)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPDE x3))); fst (lookupAround2 p (ksPSpace s)) = Some (p, KOArch (KOPDE x3)); case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBitsKO (KOArch (KOPDE x3)) \<le> x - p\<rbrakk> \<Longrightarrow> case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBitsKO (KOArch (KOPDE x3)) \<le> x - p
 3. \<forall>(s, s')\<in>state_relation. pde_at p s \<and> (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pd_bits) = Some y);
pd <- case the (x ((p && ~~ mask 6) && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) s). (t, t') \<in> state_relation \<and> pde_relation' r r') proof (prove)
goal (2 subgoals):
 1. \<And>s x3. \<lbrakk>vs_valid_duplicates' (ksPSpace s); ksPSpace s p = Some (KOArch (KOPDE x3)); pspace_aligned' s; pspace_distinct' s; is_aligned p (objBitsKO (KOArch (KOPDE x3))); fst (lookupAround2 p (ksPSpace s)) = Some (p, KOArch (KOPDE x3)); case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBitsKO (KOArch (KOPDE x3)) \<le> x - p\<rbrakk> \<Longrightarrow> case snd (lookupAround2 p (ksPSpace s)) of None \<Rightarrow> True | Some x \<Rightarrow> 2 ^ objBitsKO (KOArch (KOPDE x3)) \<le> x - p
 2. \<forall>(s, s')\<in>state_relation. pde_at p s \<and> (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pd_bits) = Some y);
pd <- case the (x ((p && ~~ mask 6) && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) s). (t, t') \<in> state_relation \<and> pde_relation' r r') proof (prove)
goal (1 subgoal):
 1. \<forall>(s, s')\<in>state_relation. pde_at p s \<and> (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). \<exists>(r, t)\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pd_bits) = Some y);
pd <- case the (x ((p && ~~ mask 6) && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) s). (t, t') \<in> state_relation \<and> pde_relation' r r') proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>state_relation. case x of (s, s') \<Rightarrow> pde_at p s \<and> pde_at' p s' \<and> vs_valid_duplicates' (ksPSpace s') \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<longrightarrow> (\<forall>x\<in>fst ((do map <- gets ksPSpace;
pa <- assert_opt (fst (lookupAround2 p map));
loadObject_default p (fst pa) (snd (lookupAround2 p map)) (snd pa)
od) s'). case x of (r', t') \<Rightarrow> \<exists>x\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x ((p && ~~ mask 6) && ~~ mask pd_bits) = Some y);
pd <- case the (x ((p && ~~ mask 6) && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) s). case x of (r, t) \<Rightarrow> (t, t') \<in> state_relation \<and> pde_relation' r r') proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>(a, b) \<in> state_relation; pde_at p a; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do x <- gets kheap;
xa <- assert (\<exists>y. x (p && ~~ mask pd_bits) = Some y);
pd <- case the (x (p && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>(a, b) \<in> state_relation; pde_at p a; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do x <- assert (\<exists>y. kheap a (p && ~~ mask pd_bits) = Some y);
pd <- case the (kheap a (p && ~~ mask pd_bits)) of ArchObj (PageDirectory xa) \<Rightarrow> return xa | ArchObj _ \<Rightarrow> fail | _ \<Rightarrow> fail;
case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p
od) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((case pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) of ARM_A.SuperSectionPDE x xa xb \<Rightarrow> return (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) | _ \<Rightarrow> get_pde p) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE \<longrightarrow> (\<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa)) \<and> ((\<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23) \<longrightarrow> (\<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa)) \<and> ((\<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34) \<longrightarrow> (\<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa)) \<and> (\<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa)) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE\<rbrakk> \<Longrightarrow> (a, ba) \<in> state_relation \<and> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; is_aligned p (objBitsKO (KOArch (KOPDE aa))); ps_clear p (objBitsKO (KOArch (KOPDE aa))) b\<rbrakk> \<Longrightarrow> (a, ba) \<in> state_relation \<and> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa pd. \<lbrakk>(a, b) \<in> state_relation; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa pd. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (6 subgoals):
 1. \<And>a b aa pd. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace (?s'93 a b aa pd))
 2. \<And>a b aa pd. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ksPSpace (?s'93 a b aa pd) ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde93 a b aa pd)))
 3. \<And>a b aa pd. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) (?pde93 a b aa pd)\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 6. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (5 subgoals):
 1. \<And>a b aa pd. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde93 a b aa pd)))
 2. \<And>a b aa pd. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) (?pde93 a b aa pd)\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa pd. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> False
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (7 subgoals):
 1. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask 6) 2
 2. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> p && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))) = (p && ~~ mask 6) && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))))
 3. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 4. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> False
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 6. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 7. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (6 subgoals):
 1. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> p && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))) = (p && ~~ mask 6) && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))))
 2. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 3. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> False
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 6. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (5 subgoals):
 1. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 2. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> False
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (6 subgoals):
 1. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace (?s'145 a b pd x41 x42 x43 x44 x45 x46))
 2. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace (?s'145 a b pd x41 x42 x43 x44 x45 x46) ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde145 a b pd x41 x42 x43 x44 x45 x46)))
 3. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde145 a b pd x41 x42 x43 x44 x45 x46)\<rbrakk> \<Longrightarrow> False
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 6. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (5 subgoals):
 1. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde145 a b pd x41 x42 x43 x44 x45 x46)))
 2. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde145 a b pd x41 x42 x43 x44 x45 x46)\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (5 subgoals):
 1. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace b (((p && ~~ mask 6) && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde145 a b pd x41 x42 x43 x44 x45 x46)))
 2. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde145 a b pd x41 x42 x43 x44 x45 x46)\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (6 subgoals):
 1. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask 6) 2
 2. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (?pde148 a b pd x41 x42 x43 x44 x45 x46 (?a148 a b pd x41 x42 x43 x44 x45 x46) b (?pd148 a b pd x41 x42 x43 x44 x45 x46) (?x41.148 a b pd x41 x42 x43 x44 x45 x46) (?x42.148 a b pd x41 x42 x43 x44 x45 x46) (?x43.148 a b pd x41 x42 x43 x44 x45 x46) (?x44.148 a b pd x41 x42 x43 x44 x45 x46) (?x45.148 a b pd x41 x42 x43 x44 x45 x46) (?x46.148 a b pd x41 x42 x43 x44 x45 x46))))
 3. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde148 a b pd x41 x42 x43 x44 x45 x46 (?a148 a b pd x41 x42 x43 x44 x45 x46) b (?pd148 a b pd x41 x42 x43 x44 x45 x46) (?x41.148 a b pd x41 x42 x43 x44 x45 x46) (?x42.148 a b pd x41 x42 x43 x44 x45 x46) (?x43.148 a b pd x41 x42 x43 x44 x45 x46) (?x44.148 a b pd x41 x42 x43 x44 x45 x46) (?x45.148 a b pd x41 x42 x43 x44 x45 x46) (?x46.148 a b pd x41 x42 x43 x44 x45 x46))\<rbrakk> \<Longrightarrow> False
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 6. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (5 subgoals):
 1. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (?pde148 a b pd x41 x42 x43 x44 x45 x46 (?a148 a b pd x41 x42 x43 x44 x45 x46) b (?pd148 a b pd x41 x42 x43 x44 x45 x46) (?x41.148 a b pd x41 x42 x43 x44 x45 x46) (?x42.148 a b pd x41 x42 x43 x44 x45 x46) (?x43.148 a b pd x41 x42 x43 x44 x45 x46) (?x44.148 a b pd x41 x42 x43 x44 x45 x46) (?x45.148 a b pd x41 x42 x43 x44 x45 x46) (?x46.148 a b pd x41 x42 x43 x44 x45 x46))))
 2. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde148 a b pd x41 x42 x43 x44 x45 x46 (?a148 a b pd x41 x42 x43 x44 x45 x46) b (?pd148 a b pd x41 x42 x43 x44 x45 x46) (?x41.148 a b pd x41 x42 x43 x44 x45 x46) (?x42.148 a b pd x41 x42 x43 x44 x45 x46) (?x43.148 a b pd x41 x42 x43 x44 x45 x46) (?x44.148 a b pd x41 x42 x43 x44 x45 x46) (?x45.148 a b pd x41 x42 x43 x44 x45 x46) (?x46.148 a b pd x41 x42 x43 x44 x45 x46))\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b pd x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.InvalidPDE; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)\<rbrakk> \<Longrightarrow> False
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x21 x22 x23. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa ba pd x21 x22 x23. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> (a, ba) \<in> state_relation \<and> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa ba pd x21 x22 x23. \<lbrakk>(a, b) \<in> state_relation; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; is_aligned p (objBitsKO (KOArch (KOPDE aa))); ps_clear p (objBitsKO (KOArch (KOPDE aa))) b\<rbrakk> \<Longrightarrow> (a, ba) \<in> state_relation \<and> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pd x21 x22 x23. \<lbrakk>(a, b) \<in> state_relation; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pd x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (5 subgoals):
 1. \<And>a b aa pd x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace (?s'179 a b aa pd x21 x22 x23))
 2. \<And>a b aa pd x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ksPSpace (?s'179 a b aa pd x21 x22 x23) ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde179 a b aa pd x21 x22 x23)))
 3. \<And>a b aa pd x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) (?pde179 a b aa pd x21 x22 x23)\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa pd x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde179 a b aa pd x21 x22 x23)))
 2. \<And>a b aa pd x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) (?pde179 a b aa pd x21 x22 x23)\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pd x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (3 subgoals):
 1. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> False
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (6 subgoals):
 1. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask 6) 2
 2. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> p && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))) = (p && ~~ mask 6) && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))))
 3. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 4. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> False
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 6. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (5 subgoals):
 1. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> p && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))) = (p && ~~ mask 6) && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))))
 2. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 3. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> False
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 2. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (3 subgoals):
 1. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> False
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (5 subgoals):
 1. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace (?s'231 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46))
 2. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace (?s'231 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde231 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46)))
 3. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde231 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46)\<rbrakk> \<Longrightarrow> False
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde231 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46)))
 2. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde231 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46)\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace b (((p && ~~ mask 6) && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde231 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46)))
 2. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde231 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46)\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (5 subgoals):
 1. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask 6) 2
 2. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (?pde234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46 (?a234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) b (?pd234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x21.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x22.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x23.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x41.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x42.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x43.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x44.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x45.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x46.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46))))
 3. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46 (?a234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) b (?pd234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x21.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x22.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x23.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x41.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x42.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x43.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x44.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x45.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x46.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46))\<rbrakk> \<Longrightarrow> False
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (?pde234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46 (?a234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) b (?pd234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x21.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x22.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x23.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x41.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x42.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x43.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x44.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x45.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x46.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46))))
 2. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46 (?a234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) b (?pd234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x21.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x22.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x23.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x41.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x42.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x43.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x44.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x45.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46) (?x46.234 a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46))\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (3 subgoals):
 1. \<And>a b pd x21 x22 x23 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.PageTablePDE x21 x22 x23; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)\<rbrakk> \<Longrightarrow> False
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); \<exists>x31 x32 x33 x34. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (get_pde p a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ba pd x31 x32 x33 x34. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> (a, ba) \<in> state_relation \<and> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa ba pd x31 x32 x33 x34. \<lbrakk>(a, b) \<in> state_relation; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; is_aligned p (objBitsKO (KOArch (KOPDE aa))); ps_clear p (objBitsKO (KOArch (KOPDE aa))) b\<rbrakk> \<Longrightarrow> (a, ba) \<in> state_relation \<and> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pd x31 x32 x33 x34. \<lbrakk>(a, b) \<in> state_relation; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pd x31 x32 x33 x34. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa pd x31 x32 x33 x34. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace (?s'266 a b aa pd x31 x32 x33 x34))
 2. \<And>a b aa pd x31 x32 x33 x34. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ksPSpace (?s'266 a b aa pd x31 x32 x33 x34) ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde266 a b aa pd x31 x32 x33 x34)))
 3. \<And>a b aa pd x31 x32 x33 x34. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) (?pde266 a b aa pd x31 x32 x33 x34)\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pd x31 x32 x33 x34. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde266 a b aa pd x31 x32 x33 x34)))
 2. \<And>a b aa pd x31 x32 x33 x34. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) (?pde266 a b aa pd x31 x32 x33 x34)\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pd x31 x32 x33 x34. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa\<rbrakk> \<Longrightarrow> pde_relation' (pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2))) aa
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (2 subgoals):
 1. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> False
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (5 subgoals):
 1. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask 6) 2
 2. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> p && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))) = (p && ~~ mask 6) && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))))
 3. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 4. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> False
 5. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> p && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))) = (p && ~~ mask 6) && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))))
 2. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 3. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> False
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (3 subgoals):
 1. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4\<rbrakk> \<Longrightarrow> vs_valid_duplicates' (ksPSpace b)
 2. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (2 subgoals):
 1. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> False
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace (?s'318 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46))
 2. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace (?s'318 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde318 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46)))
 3. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde318 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46)\<rbrakk> \<Longrightarrow> False
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (3 subgoals):
 1. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde318 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46)))
 2. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde318 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46)\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (3 subgoals):
 1. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace b (((p && ~~ mask 6) && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde318 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46)))
 2. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde318 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46)\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (4 subgoals):
 1. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask 6) 2
 2. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (?pde321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46 (?a321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) b (?pd321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x31.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x32.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x33.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x34.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x41.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x42.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x43.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x44.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x45.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x46.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46))))
 3. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46 (?a321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) b (?pd321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x31.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x32.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x33.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x34.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x41.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x42.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x43.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x44.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x45.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x46.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46))\<rbrakk> \<Longrightarrow> False
 4. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (3 subgoals):
 1. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)))\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (?pde321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46 (?a321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) b (?pd321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x31.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x32.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x33.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x34.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x41.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x42.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x43.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x44.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x45.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x46.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46))))
 2. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46 (?a321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) b (?pd321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x31.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x32.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x33.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x34.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x41.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x42.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x43.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x44.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x45.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46) (?x46.321 a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46))\<rbrakk> \<Longrightarrow> False
 3. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (2 subgoals):
 1. \<And>a b pd x31 x32 x33 x34 x41 x42 x43 x44 x45 x46. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2)) = ARM_A.InvalidPDE; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ps_clear p 2 b; is_aligned p 2; pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SectionPDE x31 x32 x33 x34; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; \<not> is_aligned (p >> 2) 4; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46))); pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46)\<rbrakk> \<Longrightarrow> False
 2. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba pd. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> \<forall>x41 x42 x43. pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43 \<longrightarrow> (\<exists>x\<in>fst (return (ARM_A.SuperSectionPDE x41 x42 x43) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation \<and> pde_relation' r aa) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba pd x41 x42 x43. \<lbrakk>(a, b) \<in> state_relation; pde_at' p b; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> (a, ba) \<in> state_relation \<and> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba pd x41 x42 x43. \<lbrakk>(a, b) \<in> state_relation; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); is_aligned p (objBits aa); ((), ba) \<in> fst (magnitudeCheck p (snd (lookupAround2 p (ksPSpace b))) (objBits aa) b); is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; is_aligned p (objBitsKO (KOArch (KOPDE aa))); ps_clear p (objBitsKO (KOArch (KOPDE aa))) b\<rbrakk> \<Longrightarrow> (a, ba) \<in> state_relation \<and> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pd x41 x42 x43. \<lbrakk>(a, b) \<in> state_relation; vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pd x41 x42 x43. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; pspace_distinct' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa pd x41 x42 x43. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pde_at (p && ~~ mask 6) a
 2. \<And>a b aa pd x41 x42 x43. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace b)
 3. \<And>a b aa pd x41 x42 x43. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' b
 4. \<And>a b aa pd x41 x42 x43. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pde_at' (p && ~~ mask 6) b\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pd x41 x42 x43. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace b)
 2. \<And>a b aa pd x41 x42 x43. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' b
 3. \<And>a b aa pd x41 x42 x43. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pde_at' (p && ~~ mask 6) b\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pd x41 x42 x43. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' b
 2. \<And>a b aa pd x41 x42 x43. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pde_at' (p && ~~ mask 6) b\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pd x41 x42 x43. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; pde_at' (p && ~~ mask 6) b\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pd x41 x42 x43 ko. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some ko; is_aligned (p && ~~ mask 6) (objBitsKO ko); koTypeOf ko = ArchT PDET; ps_clear (p && ~~ mask 6) (objBitsKO ko) b\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pd x41 x42 x43 ko x8. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch x8); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch x8)); archTypeOf x8 = PDET; ps_clear (p && ~~ mask 6) (objBitsKO (KOArch x8)) b; ko = KOArch x8\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pd x41 x42 x43 ko arch_kernel_object. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch arch_kernel_object); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch arch_kernel_object)); archTypeOf arch_kernel_object = PDET; ps_clear (p && ~~ mask 6) (objBitsKO (KOArch arch_kernel_object)) b; ko = KOArch arch_kernel_object\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pd x41 x42 x43 ko arch_kernel_object x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b; ko = KOArch (KOPDE x3); arch_kernel_object = KOPDE x3\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pd x41 x42 x43 x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pd x41 x42 x43 x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b\<rbrakk> \<Longrightarrow> pspace_relation (kheap a) (ksPSpace (?s'381 a b aa pd x41 x42 x43 x3))
 2. \<And>a b aa pd x41 x42 x43 x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b\<rbrakk> \<Longrightarrow> ksPSpace (?s'381 a b aa pd x41 x42 x43 x3) ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde381 a b aa pd x41 x42 x43 x3)))
 3. \<And>a b aa pd x41 x42 x43 x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde381 a b aa pd x41 x42 x43 x3)\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pd x41 x42 x43 x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b\<rbrakk> \<Longrightarrow> ksPSpace b ((p && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde381 a b aa pd x41 x42 x43 x3)))
 2. \<And>a b aa pd x41 x42 x43 x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde381 a b aa pd x41 x42 x43 x3)\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pd x41 x42 x43 x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b\<rbrakk> \<Longrightarrow> ksPSpace b (((p && ~~ mask 6) && ~~ mask pd_bits) + (UCAST(12 \<rightarrow> 32) (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) << 2)) = Some (KOArch (KOPDE (?pde381 a b aa pd x41 x42 x43 x3)))
 2. \<And>a b aa pd x41 x42 x43 x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde381 a b aa pd x41 x42 x43 x3)\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pd x41 x42 x43 x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b\<rbrakk> \<Longrightarrow> is_aligned (p && ~~ mask 6) 2
 2. \<And>a b aa pd x41 x42 x43 x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (?pde384 a b aa pd x41 x42 x43 x3 (?a384 a b aa pd x41 x42 x43 x3) b (?aa384 a b aa pd x41 x42 x43 x3) (?pd384 a b aa pd x41 x42 x43 x3) (?x41.384 a b aa pd x41 x42 x43 x3) (?x42.384 a b aa pd x41 x42 x43 x3) (?x43.384 a b aa pd x41 x42 x43 x3) (?x3.384 a b aa pd x41 x42 x43 x3))))
 3. \<And>a b aa pd x41 x42 x43 x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde384 a b aa pd x41 x42 x43 x3 (?a384 a b aa pd x41 x42 x43 x3) b (?aa384 a b aa pd x41 x42 x43 x3) (?pd384 a b aa pd x41 x42 x43 x3) (?x41.384 a b aa pd x41 x42 x43 x3) (?x42.384 a b aa pd x41 x42 x43 x3) (?x43.384 a b aa pd x41 x42 x43 x3) (?x3.384 a b aa pd x41 x42 x43 x3))\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pd x41 x42 x43 x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a ((p && ~~ mask 6) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (?pde384 a b aa pd x41 x42 x43 x3 (?a384 a b aa pd x41 x42 x43 x3) b (?aa384 a b aa pd x41 x42 x43 x3) (?pd384 a b aa pd x41 x42 x43 x3) (?x41.384 a b aa pd x41 x42 x43 x3) (?x42.384 a b aa pd x41 x42 x43 x3) (?x43.384 a b aa pd x41 x42 x43 x3) (?x3.384 a b aa pd x41 x42 x43 x3))))
 2. \<And>a b aa pd x41 x42 x43 x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) (?pde384 a b aa pd x41 x42 x43 x3 (?a384 a b aa pd x41 x42 x43 x3) b (?aa384 a b aa pd x41 x42 x43 x3) (?pd384 a b aa pd x41 x42 x43 x3) (?x41.384 a b aa pd x41 x42 x43 x3) (?x42.384 a b aa pd x41 x42 x43 x3) (?x43.384 a b aa pd x41 x42 x43 x3) (?x3.384 a b aa pd x41 x42 x43 x3))\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pd x41 x42 x43 x3. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE x3)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE x3))) b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) x3\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pd x41 x42 x43 pde. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE pde)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE pde))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE pde))) b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) pde\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa pd x41 x42 x43 pde. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE pde)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE pde))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE pde))) b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) pde; pde = ARM_H.InvalidPDE\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)
 2. \<And>a b aa pd x41 x42 x43 pde x21 x22 x23. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE pde)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE pde))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE pde))) b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) pde; pde = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)
 3. \<And>a b aa pd x41 x42 x43 pde x31 x32 x33 x34 x35 x36 x37. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE pde)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE pde))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE pde))) b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) pde; pde = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)
 4. \<And>a b aa pd x41 x42 x43 pde x41a x42a x43a x44 x45 x46. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE pde)); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE pde))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE pde))) b; pde_relation_aligned (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) (pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2))) pde; pde = ARM_H.SuperSectionPDE x41a x42a x43a x44 x45 x46\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pd x41 x42 x43 pde x41a. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))) b; x41a = x41; pde = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pd x41 x42 x43. \<lbrakk>vs_valid_duplicates' (ksPSpace b); pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))) b\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (4 subgoals):
 1. \<And>a b aa pd x41 x42 x43. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))) b\<rbrakk> \<Longrightarrow> ksPSpace b (p && ~~ mask 6) = Some (?ko389 a b aa pd x41 x42 x43)
 2. \<And>a b aa pd x41 x42 x43. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))) b\<rbrakk> \<Longrightarrow> is_aligned p 2
 3. \<And>a b aa pd x41 x42 x43. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))) b\<rbrakk> \<Longrightarrow> (p && ~~ mask 6) && ~~ mask (vs_ptr_align (?ko389 a b aa pd x41 x42 x43)) = p && ~~ mask (vs_ptr_align (?ko389 a b aa pd x41 x42 x43))
 4. \<And>a b aa pd x41 x42 x43. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))) b; ksPSpace b p = Some (?ko389 a b aa pd x41 x42 x43)\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (3 subgoals):
 1. \<And>a b aa pd x41 x42 x43. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))) b\<rbrakk> \<Longrightarrow> is_aligned p 2
 2. \<And>a b aa pd x41 x42 x43. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))) b\<rbrakk> \<Longrightarrow> (p && ~~ mask 6) && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))) = p && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)))))
 3. \<And>a b aa pd x41 x42 x43. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))) b; ksPSpace b p = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (2 subgoals):
 1. \<And>a b aa pd x41 x42 x43. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))) b\<rbrakk> \<Longrightarrow> (p && ~~ mask 6) && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))) = p && ~~ mask (vs_ptr_align (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)))))
 2. \<And>a b aa pd x41 x42 x43. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))) b; ksPSpace b p = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal (1 subgoal):
 1. \<And>a b aa pd x41 x42 x43. \<lbrakk>pspace_aligned' b; ksPSpace b p = Some (KOArch (KOPDE aa)); ps_clear p 2 b; is_aligned p 2; kheap a (p && ~~ mask pd_bits) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) ((p && ~~ mask 6) && mask pd_bits >> 2)) = ARM_A.SuperSectionPDE x41 x42 x43; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksPSpace b (p && ~~ mask 6) = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43)))); is_aligned (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))); ps_clear (p && ~~ mask 6) (objBitsKO (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))) b; ksPSpace b p = Some (KOArch (KOPDE (ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43))))\<rbrakk> \<Longrightarrow> aa = ARM_H.SuperSectionPDE x41 (ParityEnabled \<in> x42) (PageCacheable \<in> x42) (Global \<in> x42) (XNever \<in> x42) (vmrights_map x43) proof (prove)
goal:
No subgoals! proof (state)
this:
corres pde_relation' (pde_at p) (pde_at' p and (\<lambda>s. vs_valid_duplicates' (ksPSpace s)) and pspace_aligned' and pspace_distinct') (get_master_pde p) (getObject p)

goal:
No subgoals!