theory Arch_R

lemma performASIDControlInvocation_corres:
  "asid_ci_map i = i' \<Longrightarrow>
  corres dc
         (einvs and ct_active and valid_aci i)
         (invs' and ct_active' and valid_aci' i')
         (perform_asid_control_invocation i)
         (performASIDControlInvocation i')" supply
    is_aligned_neg_mask_eq[simp del]
    is_aligned_neg_mask_weaken[simp del] apply (cases i) apply (rename_tac word1 prod1 prod2 word2) apply (clarsimp simp: asid_ci_map_def) apply (simp add: perform_asid_control_invocation_def placeNewObject_def2
                   performASIDControlInvocation_def) apply (rule corres_name_pre) apply (clarsimp simp:valid_aci_def valid_aci'_def cte_wp_at_ctes_of cte_wp_at_caps_of_state) apply (subgoal_tac "valid_cap' (capability.UntypedCap False word1 pageBits idx) s'") prefer 2 apply (case_tac ctea) apply clarsimp apply (erule ctes_of_valid_cap') apply fastforce apply (frule valid_capAligned) apply (clarsimp simp: capAligned_def page_bits_def) apply (rule corres_guard_imp) apply (rule corres_split) apply (erule deleteObjects_corres) apply (simp add:pageBits_def) apply (rule corres_split[OF getSlotCap_corres]) apply simp apply (rule_tac F = " pcap = (cap.UntypedCap False word1 pageBits idxa)" in corres_gen_asm) apply (rule corres_split[OF updateFreeIndex_corres]) apply (clarsimp simp:is_cap_simps) apply (simp add: free_index_of_def) apply (rule corres_split) apply (simp add: retype_region2_ext_retype_region_ArchObject ) apply (rule corres_retype [where ty="Inl (KOArch (KOASIDPool F))",
                                        unfolded APIType_map2_def makeObjectKO_def,
                                        THEN createObjects_corres',simplified,
                                        where val = "makeObject::asidpool"]) apply simp apply (simp add: objBits_simps obj_bits_api_def arch_kobj_size_def
                                   default_arch_object_def archObjSize_def)+ apply (simp add: obj_relation_retype_def default_object_def
                                default_arch_object_def objBits_simps archObjSize_def) apply (simp add: other_obj_relation_def asid_pool_relation_def) apply (simp add: makeObject_asidpool const_def inv_def) apply (rule range_cover_full) apply (simp add:obj_bits_api_def arch_kobj_size_def default_arch_object_def)+ apply (rule corres_split) apply (rule cteInsert_simple_corres, simp, rule refl, rule refl) apply (rule_tac F="is_aligned word2 asid_low_bits" in corres_gen_asm) apply (simp add: is_aligned_mask dc_def[symmetric]) apply (rule corres_split[where P=\<top> and P'=\<top> and r'="\<lambda>t t'. t = t' o ucast"]) apply (clarsimp simp: state_relation_def arch_state_relation_def) apply (rule corres_trivial) apply (rule corres_modify) apply (thin_tac "x \<in> state_relation" for x) apply (clarsimp simp: state_relation_def arch_state_relation_def o_def) apply (rule ext) apply clarsimp apply (erule_tac P = "x = asid_high_bits_of word2" in notE) apply (rule word_eqI[rule_format]) apply (drule_tac x1="ucast x" in bang_eq [THEN iffD1]) apply (erule_tac x=n in allE) apply (simp add: word_size nth_ucast) apply wp+ apply (strengthen safe_parent_strg[where idx = "2^pageBits"]) apply (strengthen invs_valid_objs invs_distinct
                             invs_psp_aligned invs_mdb
                  | simp cong:conj_cong)+ apply (wp retype_region_plain_invs[where sz = pageBits]
                     retype_cte_wp_at[where sz = pageBits])+ apply (strengthen vp_strgs'
                 safe_parent_strg'[where idx = "2^pageBits"]) apply (simp cong: conj_cong) apply (wp createObjects_valid_pspace'
                    [where sz = pageBits and ty="Inl (KOArch (KOASIDPool undefined))"]) apply (simp add: makeObjectKO_def)+ apply (simp add:objBits_simps archObjSize_def range_cover_full)+ apply (clarsimp simp:valid_cap'_def) apply (wp createObject_typ_at'
                    createObjects_orig_cte_wp_at'[where sz = pageBits]) apply (rule descendants_of'_helper) apply (wp createObjects_null_filter'
                    [where sz = pageBits and ty="Inl (KOArch (KOASIDPool undefined))"]) apply (clarsimp simp: conj_comms obj_bits_api_def arch_kobj_size_def
                objBits_simps archObjSize_def default_arch_object_def
                pred_conj_def) apply (clarsimp simp: conj_comms
               | strengthen invs_mdb invs_valid_pspace)+ apply (simp add:region_in_kernel_window_def) apply (wp set_untyped_cap_invs_simple[where sz = pageBits]
                   set_cap_cte_wp_at
                   set_cap_caps_no_overlap[where sz = pageBits]
                   set_cap_no_overlap
                   set_cap_device_and_range_aligned[where dev = False,simplified]
                   set_untyped_cap_caps_overlap_reserved[where sz = pageBits])+ apply (clarsimp simp: conj_comms obj_bits_api_def arch_kobj_size_def
                              objBits_simps archObjSize_def default_arch_object_def
                              makeObjectKO_def range_cover_full
                        simp del: capFreeIndex_update.simps
               | strengthen invs_valid_pspace' invs_pspace_aligned'
                            invs_pspace_distinct'
                            exI[where x="makeObject :: asidpool"])+ apply (wp updateFreeIndex_forward_invs'
          updateFreeIndex_pspace_no_overlap'
          updateFreeIndex_caps_no_overlap''
          updateFreeIndex_descendants_of2
          updateFreeIndex_cte_wp_at
          updateFreeIndex_caps_overlap_reserved
            | simp add: descendants_of_null_filter' split del: if_split)+ apply (wp get_cap_wp)+ apply (subgoal_tac "word1 && ~~ mask pageBits = word1 \<and> pageBits \<le> word_bits \<and> word_size_bits \<le> pageBits") prefer 2 apply (clarsimp simp:pageBits_def word_bits_def is_aligned_neg_mask_eq word_size_bits_def) apply (simp only:delete_objects_rewrite) apply wp+ apply (clarsimp simp: conj_comms) apply (clarsimp simp: conj_comms ex_disj_distrib
           | strengthen invs_valid_pspace' invs_pspace_aligned'
                        invs_pspace_distinct')+ apply (wp deleteObjects_invs'[where p="makePoolParent i'"]
              deleteObjects_cte_wp_at'
              deleteObjects_descendants[where p="makePoolParent i'"]) apply (clarsimp split del: if_split simp:valid_cap'_def) apply (wp hoare_vcg_ex_lift
              deleteObjects_caps_no_overlap''[where slot="makePoolParent i'"]
              deleteObject_no_overlap
              deleteObjects_ct_active'[where cref="makePoolParent i'"]) apply (clarsimp simp: is_simple_cap_def valid_cap'_def max_free_index_def is_cap_simps
                    cong: conj_cong) apply (strengthen empty_descendants_range_in') apply (wp deleteObjects_descendants[where p="makePoolParent i'"]
              deleteObjects_cte_wp_at'
              deleteObjects_null_filter[where p="makePoolParent i'"]) apply (clarsimp simp:invs_mdb max_free_index_def invs_untyped_children) apply (subgoal_tac "detype_locale x y sa" for x y) prefer 2 apply (simp add:detype_locale_def) apply (fastforce simp:cte_wp_at_caps_of_state descendants_range_def2
            empty_descendants_range_in invs_untyped_children) apply (intro conjI) apply (clarsimp) apply (erule(1) caps_of_state_valid) subgoal by (fastforce simp:cte_wp_at_caps_of_state
                descendants_range_def2 empty_descendants_range_in) apply (fold_subgoals (prefix))[2] subgoal premises prems using prems by (clarsimp simp:invs_def valid_state_def)+ apply (clarsimp simp:cte_wp_at_caps_of_state) apply (drule detype_locale.non_null_present) apply (fastforce simp:cte_wp_at_caps_of_state) apply simp apply (frule_tac ptr = "(aa,ba)" in detype_invariants [rotated 3]) apply fastforce apply simp apply (simp add: cte_wp_at_caps_of_state) apply (simp add: is_cap_simps) apply (simp add:empty_descendants_range_in descendants_range_def2) apply (frule intvl_range_conv[where bits = pageBits]) apply (clarsimp simp:pageBits_def word_bits_def) apply (clarsimp simp: invs_valid_objs cte_wp_at_caps_of_state range_cover_full
                         invs_psp_aligned invs_distinct cap_master_cap_simps is_cap_simps
                         is_simple_cap_def) apply (clarsimp simp: conj_comms) apply (rule conjI,clarsimp) apply (frule ex_cte_cap_protects) apply (simp add:cte_wp_at_caps_of_state) apply (simp add:empty_descendants_range_in) apply fastforce apply (rule subset_refl) apply fastforce apply clarsimp apply (rule conjI,clarsimp simp:clear_um_def) apply (simp add:detype_clear_um_independent) apply (rule conjI,erule caps_no_overlap_detype[OF descendants_range_caps_no_overlapI]) apply (clarsimp simp:is_aligned_neg_mask_eq cte_wp_at_caps_of_state) apply (simp add:empty_descendants_range_in)+ apply (rule conjI) apply clarsimp apply (drule_tac p = "(aa,ba)" in cap_refs_in_kernel_windowD2[OF caps_of_state_cteD]) apply fastforce apply (clarsimp simp: region_in_kernel_window_def valid_cap_def
                          cap_aligned_def is_aligned_neg_mask_eq detype_def clear_um_def) apply (rule conjI, rule pspace_no_overlap_subset,
         rule pspace_no_overlap_detype[OF caps_of_state_valid]) apply (simp add:invs_psp_aligned invs_valid_objs is_aligned_neg_mask_eq)+ apply (clarsimp simp: detype_def clear_um_def detype_ext_def valid_sched_def valid_etcbs_def
            st_tcb_at_kh_def obj_at_kh_def st_tcb_at_def obj_at_def is_etcb_at_def) apply (simp add: detype_def clear_um_def) apply (drule_tac x = "cte_map (aa,ba)" in pspace_relation_cte_wp_atI[OF state_relation_pspace_relation]) apply (simp add:invs_valid_objs)+ apply clarsimp apply (drule cte_map_inj_eq) apply ((fastforce simp:cte_wp_at_caps_of_state)+)[5] apply (clarsimp simp:cte_wp_at_caps_of_state invs_valid_pspace' conj_comms cte_wp_at_ctes_of
                       valid_cap_simps') apply (strengthen refl) apply clarsimp apply (frule empty_descendants_range_in') apply (intro conjI,
    simp_all add: is_simple_cap'_def isCap_simps descendants_range'_def2
                  null_filter_descendants_of'[OF null_filter_simp']
                  capAligned_def asid_low_bits_def) apply (erule descendants_range_caps_no_overlapI') apply (fastforce simp:cte_wp_at_ctes_of is_aligned_neg_mask_eq) apply (simp add:empty_descendants_range_in') apply (simp add:word_bits_def pageBits_def) apply (rule is_aligned_weaken) apply (rule is_aligned_shiftl_self[unfolded shiftl_t2n,where p = 1,simplified]) apply (simp add:pageBits_def) apply clarsimp apply (drule(1) cte_cap_in_untyped_range) apply (fastforce simp:cte_wp_at_ctes_of) apply assumption+ apply fastforce apply simp apply clarsimp apply (drule (1) cte_cap_in_untyped_range) apply (fastforce simp add: cte_wp_at_ctes_of) apply assumption+ apply (clarsimp simp: invs'_def valid_state'_def if_unsafe_then_cap'_def cte_wp_at_ctes_of) apply fastforce apply simp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. asid_ci_map i = i' \<Longrightarrow> corres dc (einvs and ct_active and valid_aci i) (invs' and ct_active' and valid_aci' i') (perform_asid_control_invocation i) (performASIDControlInvocation i') proof (prove)
goal (1 subgoal):
 1. asid_ci_map i = i' \<Longrightarrow> corres dc (einvs and ct_active and valid_aci i) (invs' and ct_active' and valid_aci' i') (perform_asid_control_invocation i) (performASIDControlInvocation i') proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x3 x4. \<lbrakk>asid_ci_map i = i'; i = asid_control_invocation.MakePool x1 x2 x3 x4\<rbrakk> \<Longrightarrow> corres dc (einvs and ct_active and valid_aci i) (invs' and ct_active' and valid_aci' i') (perform_asid_control_invocation i) (performASIDControlInvocation i') proof (prove)
goal (1 subgoal):
 1. \<And>word1 prod1 prod2 word2. \<lbrakk>asid_ci_map i = i'; i = asid_control_invocation.MakePool word1 prod1 prod2 word2\<rbrakk> \<Longrightarrow> corres dc (einvs and ct_active and valid_aci i) (invs' and ct_active' and valid_aci' i') (perform_asid_control_invocation i) (performASIDControlInvocation i') proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2\<rbrakk> \<Longrightarrow> corres dc (einvs and ct_active and valid_aci (asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2)) (invs' and ct_active' and valid_aci' (asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2)) (perform_asid_control_invocation (asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2)) (performASIDControlInvocation (asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2)) proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2\<rbrakk> \<Longrightarrow> corres dc (einvs and ct_active and valid_aci (asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2)) (invs' and ct_active' and valid_aci' (asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2)) (do y <- delete_objects word1 page_bits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- deleteObjects word1 pageBits;
pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od) proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s s'. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (einvs and ct_active and valid_aci (asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2)) s; (invs' and ct_active' and valid_aci' (asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2)) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> corres dc ((=) s) ((=) s') (do y <- delete_objects word1 page_bits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- deleteObjects word1 pageBits;
pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od) proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None\<rbrakk> \<Longrightarrow> corres dc ((=) s) ((=) s') (do y <- delete_objects word1 page_bits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- deleteObjects word1 pageBits;
pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od) proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'\<rbrakk> \<Longrightarrow> corres dc ((=) s) ((=) s') (do y <- delete_objects word1 page_bits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- deleteObjects word1 pageBits;
pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None\<rbrakk> \<Longrightarrow> valid_cap' (capability.UntypedCap False word1 pageBits idx) s' proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None\<rbrakk> \<Longrightarrow> valid_cap' (capability.UntypedCap False word1 pageBits idx) s'
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'\<rbrakk> \<Longrightarrow> corres dc ((=) s) ((=) s') (do y <- delete_objects word1 page_bits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- deleteObjects word1 pageBits;
pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od) proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa x1 x2. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; ctea = CTE x1 x2\<rbrakk> \<Longrightarrow> valid_cap' (capability.UntypedCap False word1 pageBits idx) s'
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'\<rbrakk> \<Longrightarrow> corres dc ((=) s) ((=) s') (do y <- delete_objects word1 page_bits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- deleteObjects word1 pageBits;
pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od) proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte idx idxa x2. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some (CTE (capability.UntypedCap False word1 pageBits idx) x2); cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None\<rbrakk> \<Longrightarrow> valid_cap' (capability.UntypedCap False word1 pageBits idx) s'
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'\<rbrakk> \<Longrightarrow> corres dc ((=) s) ((=) s') (do y <- delete_objects word1 page_bits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- deleteObjects word1 pageBits;
pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od) proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte idx idxa x2. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None\<rbrakk> \<Longrightarrow> valid_objs' s'
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'\<rbrakk> \<Longrightarrow> corres dc ((=) s) ((=) s') (do y <- delete_objects word1 page_bits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- deleteObjects word1 pageBits;
pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od) proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'\<rbrakk> \<Longrightarrow> corres dc ((=) s) ((=) s') (do y <- delete_objects word1 page_bits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- deleteObjects word1 pageBits;
pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od) proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; capAligned (capability.UntypedCap False word1 pageBits idx)\<rbrakk> \<Longrightarrow> corres dc ((=) s) ((=) s') (do y <- delete_objects word1 page_bits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- deleteObjects word1 pageBits;
pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od) proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> corres dc ((=) s) ((=) s') (do y <- delete_objects word1 pageBits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- deleteObjects word1 pageBits;
pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od) proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> corres dc (?Q54 word1 a b aa ba word2 s s' cte ctea idx idxa) (?Q'54 word1 a b aa ba word2 s s' cte ctea idx idxa) (do y <- delete_objects word1 pageBits;
pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- deleteObjects word1 pageBits;
pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ?Q54 word1 a b aa ba word2 s s' cte ctea idx idxa sa
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ?Q'54 word1 a b aa ba word2 s s' cte ctea idx idxa sa proof (prove)
goal (6 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> corres (?r'58 word1 a b aa ba word2 s s' cte ctea idx idxa) (?P58 word1 a b aa ba word2 s s' cte ctea idx idxa) (?P'58 word1 a b aa ba word2 s s' cte ctea idx idxa) (delete_objects word1 pageBits) (deleteObjects word1 pageBits)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; ?r'58 word1 a b aa ba word2 s s' cte ctea idx idxa y ya\<rbrakk> \<Longrightarrow> corres dc (?R58 word1 a b aa ba word2 s s' cte ctea idx idxa y) (?R'58 word1 a b aa ba word2 s s' cte ctea idx idxa ya) (do pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>?R58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>?R'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> (?P58 word1 a b aa ba word2 s s' cte ctea idx idxa and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> (?P'58 word1 a b aa ba word2 s s' cte ctea idx idxa and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (6 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'\<rbrakk> \<Longrightarrow> 2 \<le> pageBits
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R58 word1 a b aa ba word2 s s' cte ctea idx idxa y) (?R'58 word1 a b aa ba word2 s s' cte ctea idx idxa ya) (do pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>?R58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>?R'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (5 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R58 word1 a b aa ba word2 s s' cte ctea idx idxa y) (?R'58 word1 a b aa ba word2 s s' cte ctea idx idxa ya) (do pcap <- get_cap (aa, ba);
y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do pcap <- getSlotCap (cte_map (aa, ba));
y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcap));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>?R58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>?R'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (8 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> cte_map (aa, ba) = cte_map (aa, ba)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa\<rbrakk> \<Longrightarrow> corres dc (?R65 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap) (?R'65 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa) (do y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>?R65 word1 a b aa ba word2 s s' cte ctea idx idxa y ya\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>?R'65 word1 a b aa ba word2 s s' cte ctea idx idxa y ya\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (7 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa\<rbrakk> \<Longrightarrow> corres dc (?R65 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap) (?R'65 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa) (do y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>?R65 word1 a b aa ba word2 s s' cte ctea idx idxa y ya\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>?R'65 word1 a b aa ba word2 s s' cte ctea idx idxa y ya\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (7 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> corres dc (?P75 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap) (?R'65 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa) (do y <- set_cap (max_free_index_update pcap) (aa, ba);
y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa));
y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. ?P75 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>?R'65 word1 a b aa ba word2 s s' cte ctea idx idxa y ya\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (11 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> is_untyped_cap (max_free_index_update pcap)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> free_index_of (max_free_index_update pcap) = max_free_index (capBlockSize pcapa)
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> corres dc (?R76 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb) (?R'76 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc) (do y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>?R76 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>?R'76 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> free_index_of (max_free_index_update pcap) = max_free_index (capBlockSize pcapa)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> corres dc (?R76 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb) (?R'76 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc) (do y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>?R76 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>?R'76 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (9 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> corres dc (?R76 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb) (?R'76 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc) (do y <- retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False;
y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0;
y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>?R76 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>?R'76 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (12 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> corres (?r'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc) (?P91 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb) (?P'93 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc) (retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False) (createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd ye. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc; ?r'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd ye\<rbrakk> \<Longrightarrow> corres dc (?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd) (?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc ye) (do y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. ?P91 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. ?P'93 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> corres (?r'90 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () ()) (?P91 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()) (?P'93 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()) (retype_region2 word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False) (createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd ye. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc; ?r'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd ye\<rbrakk> \<Longrightarrow> corres dc (?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd) (?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc ye) (do y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. ?P91 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. ?P'93 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
A total of 12 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> 0 < Suc 0
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> is_aligned word1 (objBitsKO (KOArch (KOASIDPool makeObject)) + 0)
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> obj_bits_api (ArchObject ASIDPoolObj) 0 = objBitsKO (KOArch (KOASIDPool makeObject)) + 0
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> KOArch (KOASIDPool makeObject) = KOArch (KOASIDPool makeObject)
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa; obj_bits_api (ArchObject ASIDPoolObj) 0 \<le> ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()\<rbrakk> \<Longrightarrow> obj_relation_retype (default_object (ArchObject ASIDPoolObj) False 0) (KOArch (KOASIDPool makeObject))
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> range_cover word1 (?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()) (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> KOArch (KOASIDPool makeObject) = injectKOS makeObject
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd ye. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc; dc yd ye\<rbrakk> \<Longrightarrow> corres dc (?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd) (?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc ye) (do y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
A total of 18 subgoals...
flex-flex pairs:
\<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz107 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()
\<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz106 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () proof (prove)
goal (17 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> is_aligned word1 (objBitsKO (KOArch (KOASIDPool makeObject)) + 0)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> obj_bits_api (ArchObject ASIDPoolObj) 0 = objBitsKO (KOArch (KOASIDPool makeObject)) + 0
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> KOArch (KOASIDPool makeObject) = KOArch (KOASIDPool makeObject)
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa; obj_bits_api (ArchObject ASIDPoolObj) 0 \<le> ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()\<rbrakk> \<Longrightarrow> obj_relation_retype (default_object (ArchObject ASIDPoolObj) False 0) (KOArch (KOASIDPool makeObject))
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> range_cover word1 (?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()) (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> KOArch (KOASIDPool makeObject) = injectKOS makeObject
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd ye. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc; dc yd ye\<rbrakk> \<Longrightarrow> corres dc (?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd) (?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc ye) (do y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>c. valid_pspace c \<and> pspace_no_overlap {word1..(word1 && ~~ mask (?sz107 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb)) + (2 ^ ?sz106 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb - 1)} c \<and> valid_mdb c \<and> valid_etcbs c \<and> valid_list c) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
\<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz107 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()
\<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz106 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () proof (prove)
goal (14 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa; pageBits \<le> ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()\<rbrakk> \<Longrightarrow> obj_relation_retype (default_object (ArchObject ASIDPoolObj) False 0) (KOArch (KOASIDPool makeObject))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> range_cover word1 (?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()) (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> KOArch (KOASIDPool makeObject) = injectKOS makeObject
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd ye. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc; dc yd ye\<rbrakk> \<Longrightarrow> corres dc (?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd) (?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc ye) (do y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>c. valid_pspace c \<and> pspace_no_overlap {word1..(word1 && ~~ mask (?sz107 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb)) + (2 ^ ?sz106 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb - 1)} c \<and> valid_mdb c \<and> valid_etcbs c \<and> valid_list c) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>c. pspace_aligned' c \<and> pspace_distinct' c \<and> pspace_no_overlap' word1 (?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc) c \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz107 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()
\<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz106 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () proof (prove)
goal (14 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa; pageBits \<le> ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()\<rbrakk> \<Longrightarrow> other_obj_relation (ArchObj (arch_kernel_obj.ASIDPool (\<lambda>_. None))) (KOArch (KOASIDPool makeObject))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> range_cover word1 (?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()) (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> KOArch (KOASIDPool makeObject) = injectKOS makeObject
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd ye. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc; dc yd ye\<rbrakk> \<Longrightarrow> corres dc (?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd) (?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc ye) (do y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>c. valid_pspace c \<and> pspace_no_overlap {word1..(word1 && ~~ mask (?sz107 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb)) + (2 ^ ?sz106 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb - 1)} c \<and> valid_mdb c \<and> valid_etcbs c \<and> valid_list c) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>c. pspace_aligned' c \<and> pspace_distinct' c \<and> pspace_no_overlap' word1 (?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc) c \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz107 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()
\<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz106 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () proof (prove)
goal (14 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa; pageBits \<le> ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()\<rbrakk> \<Longrightarrow> (\<lambda>_. None) = inv asidpool.ASIDPool makeObject \<circ> UCAST(10 \<rightarrow> 32)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> range_cover word1 (?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()) (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> KOArch (KOASIDPool makeObject) = injectKOS makeObject
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd ye. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc; dc yd ye\<rbrakk> \<Longrightarrow> corres dc (?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd) (?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc ye) (do y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>c. valid_pspace c \<and> pspace_no_overlap {word1..(word1 && ~~ mask (?sz107 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb)) + (2 ^ ?sz106 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb - 1)} c \<and> valid_mdb c \<and> valid_etcbs c \<and> valid_list c) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>c. pspace_aligned' c \<and> pspace_distinct' c \<and> pspace_no_overlap' word1 (?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc) c \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz107 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()
\<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz106 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () proof (prove)
goal (13 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> range_cover word1 (?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()) (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> KOArch (KOASIDPool makeObject) = injectKOS makeObject
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd ye. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc; dc yd ye\<rbrakk> \<Longrightarrow> corres dc (?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd) (?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc ye) (do y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>c. valid_pspace c \<and> pspace_no_overlap {word1..(word1 && ~~ mask (?sz107 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb)) + (2 ^ ?sz106 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb - 1)} c \<and> valid_mdb c \<and> valid_etcbs c \<and> valid_list c) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>c. pspace_aligned' c \<and> pspace_distinct' c \<and> pspace_no_overlap' word1 (?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc) c \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz107 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()
\<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz106 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () \<equiv>\<^sup>? \<lambda>word1 a b aa ba word2 s s' cte ctea idx idxa. ?sz104 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () proof (prove)
goal (14 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> is_aligned word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> obj_bits_api (ArchObject ASIDPoolObj) 0 < word_bits
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> KOArch (KOASIDPool makeObject) = injectKOS makeObject
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd ye. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc; dc yd ye\<rbrakk> \<Longrightarrow> corres dc (?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc yd) (?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc ye) (do y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
A total of 14 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> corres dc (?R90 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd) (?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()) (do y <- cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b);
y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b));
y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>?R90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>?R'90 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> corres (?r'118 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd) (?P131 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd) (?P'127 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()) (cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b)) (cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa; ?r'118 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y ya\<rbrakk> \<Longrightarrow> corres dc (?R118 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y) (?R'118 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd ya) (do y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>?R118 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>?R'118 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. ?P131 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. ?P'127 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa; dc y ya\<rbrakk> \<Longrightarrow> corres dc (?R118 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y) (?R'118 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd ya) (do y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>?R118 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>?R'118 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa; dc y ya; is_aligned word2 local.asid_low_bits\<rbrakk> \<Longrightarrow> corres dc (?P144 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y) (?R'118 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd ya) (do y <- assert (word2 && mask local.asid_low_bits = 0);
asid_table <- gets (arm_asid_table \<circ> arch_state);
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := asid_table(asid_high_bits_of word2 \<mapsto> word1)\<rparr>\<rparr>)
od) (do y <- assert (word2 && mask local.asid_low_bits = 0);
asidTable <- gets (armKSASIDTable \<circ> ksArchState);
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_. asidTable(UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) \<mapsto> word1)) (ksArchState s)\<rparr>)
od)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. ?P144 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>?R'118 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> corres dc (?P144 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()) (?R'118 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()) (do asid_table <- gets asid_table;
modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := \<lambda>a. if a = asid_high_bits_of word2 then Some word1 else asid_table a\<rparr>\<rparr>)
od) (do asidTable <- gets (\<lambda>a. armKSASIDTable (ksArchState a));
modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_ a. if a = UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) then Some word1 else asidTable a) (ksArchState s)\<rparr>)
od)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. ?P144 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>?R'118 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
A total of 13 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> corres (\<lambda>t t'. t = t' \<circ> UCAST(7 \<rightarrow> 32)) (\<lambda>_. True) (\<lambda>_. True) (gets asid_table) (gets (\<lambda>a. armKSASIDTable (ksArchState a)))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd asid_tablea asidTable. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa; asid_tablea = asidTable \<circ> UCAST(7 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> corres dc (?R145 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd asid_tablea) (?R'145 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd asidTable) (modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := \<lambda>a. if a = asid_high_bits_of word2 then Some word1 else asid_tablea a\<rparr>\<rparr>)) (modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_ a. if a = UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) then Some word1 else asidTable a) (ksArchState s)\<rparr>))
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets asid_table \<lbrace>?R145 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets (\<lambda>a. armKSASIDTable (ksArchState a)) \<lbrace>?R'145 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd c\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd asid_tablea asidTable. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa; asid_tablea = asidTable \<circ> UCAST(7 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> corres dc (?R145 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd asid_tablea) (?R'145 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd asidTable) (modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := \<lambda>a. if a = asid_high_bits_of word2 then Some word1 else asid_tablea a\<rparr>\<rparr>)) (modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_ a. if a = UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) then Some word1 else asidTable a) (ksArchState s)\<rparr>))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets asid_table \<lbrace>?R145 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets (\<lambda>a. armKSASIDTable (ksArchState a)) \<lbrace>?R'145 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd asid_tablea asidTable. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa; asid_tablea = asidTable \<circ> UCAST(7 \<rightarrow> 32)\<rbrakk> \<Longrightarrow> corres dc (\<lambda>_. True) (\<lambda>_. True) (modify (\<lambda>s. s\<lparr>arch_state := arch_state s\<lparr>arm_asid_table := \<lambda>a. if a = asid_high_bits_of word2 then Some word1 else asid_tablea a\<rparr>\<rparr>)) (modify (\<lambda>s. s\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_ a. if a = UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) then Some word1 else asidTable a) (ksArchState s)\<rparr>))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets asid_table \<lbrace>\<lambda>asid_table _. True\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets (\<lambda>a. armKSASIDTable (ksArchState a)) \<lbrace>\<lambda>asidTable _. True\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd asid_tablea asidTable sa s'a. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa; asid_tablea = asidTable \<circ> UCAST(7 \<rightarrow> 32); True; True; (sa, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> (sa\<lparr>arch_state := arch_state sa\<lparr>arm_asid_table := \<lambda>a. if a = asid_high_bits_of word2 then Some word1 else asid_tablea a\<rparr>\<rparr>, s'a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_ a. if a = UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) then Some word1 else asidTable a) (ksArchState s'a)\<rparr>) \<in> state_relation
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets asid_table \<lbrace>\<lambda>asid_table _. True\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets (\<lambda>a. armKSASIDTable (ksArchState a)) \<lbrace>\<lambda>asidTable _. True\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd asid_tablea asidTable sa s'a. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa; asid_tablea = asidTable \<circ> UCAST(7 \<rightarrow> 32); True; True; (sa, s'a) \<in> state_relation\<rbrakk> \<Longrightarrow> (sa\<lparr>arch_state := arch_state sa\<lparr>arm_asid_table := \<lambda>a. if a = asid_high_bits_of word2 then Some word1 else asid_tablea a\<rparr>\<rparr>, s'a\<lparr>ksArchState := armKSASIDTable_update (\<lambda>_ a. if a = UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) then Some word1 else asidTable a) (ksArchState s'a)\<rparr>) \<in> state_relation
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets asid_table \<lbrace>\<lambda>asid_table _. True\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets (\<lambda>a. armKSASIDTable (ksArchState a)) \<lbrace>\<lambda>asidTable _. True\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa asidTable sa s'a. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pspace_relation (kheap sa) (ksPSpace s'a); ekheap_relation (ekheap sa) (ksPSpace s'a); sched_act_relation (scheduler_action sa) (ksSchedulerAction s'a); ready_queues_relation (ready_queues sa) (ksReadyQueues s'a); ghost_relation (kheap sa) (gsUserPages s'a) (gsCNodes s'a); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s'a); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s'a); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s'a); asid_table sa = (\<lambda>x. armKSASIDTable (ksArchState s'a) (UCAST(7 \<rightarrow> 32) x)); arm_global_pd (arch_state sa) = armKSGlobalPD (ksArchState s'a); arm_hwasid_table (arch_state sa) = armKSHWASIDTable (ksArchState s'a); arm_global_pts (arch_state sa) = armKSGlobalPTs (ksArchState s'a); arm_next_asid (arch_state sa) = armKSNextASID (ksArchState s'a); arm_asid_map (arch_state sa) = armKSASIDMap (ksArchState s'a); arm_kernel_vspace (arch_state sa) = armKSKernelVSpace (ksArchState s'a); interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s'a); cur_thread sa = ksCurThread s'a; idle_thread sa = ksIdleThread s'a; machine_state sa = ksMachineState s'a; work_units_completed sa = ksWorkUnitsCompleted s'a; domain_index sa = ksDomScheduleIdx s'a; domain_list sa = ksDomSchedule s'a; cur_domain sa = ksCurDomain s'a; domain_time sa = ksDomainTime s'a\<rbrakk> \<Longrightarrow> (\<lambda>a. if a = asid_high_bits_of word2 then Some word1 else asidTable (UCAST(7 \<rightarrow> 32) a)) = (\<lambda>x. if UCAST(7 \<rightarrow> 32) x = UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) then Some word1 else asidTable (UCAST(7 \<rightarrow> 32) x))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets asid_table \<lbrace>\<lambda>asid_table _. True\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets (\<lambda>a. armKSASIDTable (ksArchState a)) \<lbrace>\<lambda>asidTable _. True\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa asidTable sa s'a x. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pspace_relation (kheap sa) (ksPSpace s'a); ekheap_relation (ekheap sa) (ksPSpace s'a); sched_act_relation (scheduler_action sa) (ksSchedulerAction s'a); ready_queues_relation (ready_queues sa) (ksReadyQueues s'a); ghost_relation (kheap sa) (gsUserPages s'a) (gsCNodes s'a); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s'a); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s'a); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s'a); asid_table sa = (\<lambda>x. armKSASIDTable (ksArchState s'a) (UCAST(7 \<rightarrow> 32) x)); arm_global_pd (arch_state sa) = armKSGlobalPD (ksArchState s'a); arm_hwasid_table (arch_state sa) = armKSHWASIDTable (ksArchState s'a); arm_global_pts (arch_state sa) = armKSGlobalPTs (ksArchState s'a); arm_next_asid (arch_state sa) = armKSNextASID (ksArchState s'a); arm_asid_map (arch_state sa) = armKSASIDMap (ksArchState s'a); arm_kernel_vspace (arch_state sa) = armKSKernelVSpace (ksArchState s'a); interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s'a); cur_thread sa = ksCurThread s'a; idle_thread sa = ksIdleThread s'a; machine_state sa = ksMachineState s'a; work_units_completed sa = ksWorkUnitsCompleted s'a; domain_index sa = ksDomScheduleIdx s'a; domain_list sa = ksDomSchedule s'a; cur_domain sa = ksCurDomain s'a; domain_time sa = ksDomainTime s'a\<rbrakk> \<Longrightarrow> (if x = asid_high_bits_of word2 then Some word1 else asidTable (UCAST(7 \<rightarrow> 32) x)) = (if UCAST(7 \<rightarrow> 32) x = UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) then Some word1 else asidTable (UCAST(7 \<rightarrow> 32) x))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets asid_table \<lbrace>\<lambda>asid_table _. True\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets (\<lambda>a. armKSASIDTable (ksArchState a)) \<lbrace>\<lambda>asidTable _. True\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa asidTable sa s'a x. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pspace_relation (kheap sa) (ksPSpace s'a); ekheap_relation (ekheap sa) (ksPSpace s'a); sched_act_relation (scheduler_action sa) (ksSchedulerAction s'a); ready_queues_relation (ready_queues sa) (ksReadyQueues s'a); ghost_relation (kheap sa) (gsUserPages s'a) (gsCNodes s'a); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s'a); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s'a); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s'a); asid_table sa = (\<lambda>x. armKSASIDTable (ksArchState s'a) (UCAST(7 \<rightarrow> 32) x)); arm_global_pd (arch_state sa) = armKSGlobalPD (ksArchState s'a); arm_hwasid_table (arch_state sa) = armKSHWASIDTable (ksArchState s'a); arm_global_pts (arch_state sa) = armKSGlobalPTs (ksArchState s'a); arm_next_asid (arch_state sa) = armKSNextASID (ksArchState s'a); arm_asid_map (arch_state sa) = armKSASIDMap (ksArchState s'a); arm_kernel_vspace (arch_state sa) = armKSKernelVSpace (ksArchState s'a); interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s'a); cur_thread sa = ksCurThread s'a; idle_thread sa = ksIdleThread s'a; machine_state sa = ksMachineState s'a; work_units_completed sa = ksWorkUnitsCompleted s'a; domain_index sa = ksDomScheduleIdx s'a; domain_list sa = ksDomSchedule s'a; cur_domain sa = ksCurDomain s'a; domain_time sa = ksDomainTime s'a; x \<noteq> asid_high_bits_of word2; UCAST(7 \<rightarrow> 32) x = UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2)\<rbrakk> \<Longrightarrow> asidTable (UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2)) = Some word1
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets asid_table \<lbrace>\<lambda>asid_table _. True\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets (\<lambda>a. armKSASIDTable (ksArchState a)) \<lbrace>\<lambda>asidTable _. True\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa asidTable sa s'a x. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pspace_relation (kheap sa) (ksPSpace s'a); ekheap_relation (ekheap sa) (ksPSpace s'a); sched_act_relation (scheduler_action sa) (ksSchedulerAction s'a); ready_queues_relation (ready_queues sa) (ksReadyQueues s'a); ghost_relation (kheap sa) (gsUserPages s'a) (gsCNodes s'a); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s'a); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s'a); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s'a); asid_table sa = (\<lambda>x. armKSASIDTable (ksArchState s'a) (UCAST(7 \<rightarrow> 32) x)); arm_global_pd (arch_state sa) = armKSGlobalPD (ksArchState s'a); arm_hwasid_table (arch_state sa) = armKSHWASIDTable (ksArchState s'a); arm_global_pts (arch_state sa) = armKSGlobalPTs (ksArchState s'a); arm_next_asid (arch_state sa) = armKSNextASID (ksArchState s'a); arm_asid_map (arch_state sa) = armKSASIDMap (ksArchState s'a); arm_kernel_vspace (arch_state sa) = armKSKernelVSpace (ksArchState s'a); interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s'a); cur_thread sa = ksCurThread s'a; idle_thread sa = ksIdleThread s'a; machine_state sa = ksMachineState s'a; work_units_completed sa = ksWorkUnitsCompleted s'a; domain_index sa = ksDomScheduleIdx s'a; domain_list sa = ksDomSchedule s'a; cur_domain sa = ksCurDomain s'a; domain_time sa = ksDomainTime s'a; UCAST(7 \<rightarrow> 32) x = UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2)\<rbrakk> \<Longrightarrow> x = asid_high_bits_of word2
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets asid_table \<lbrace>\<lambda>asid_table _. True\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets (\<lambda>a. armKSASIDTable (ksArchState a)) \<lbrace>\<lambda>asidTable _. True\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa asidTable sa s'a x n. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pspace_relation (kheap sa) (ksPSpace s'a); ekheap_relation (ekheap sa) (ksPSpace s'a); sched_act_relation (scheduler_action sa) (ksSchedulerAction s'a); ready_queues_relation (ready_queues sa) (ksReadyQueues s'a); ghost_relation (kheap sa) (gsUserPages s'a) (gsCNodes s'a); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s'a); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s'a); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s'a); asid_table sa = (\<lambda>x. armKSASIDTable (ksArchState s'a) (UCAST(7 \<rightarrow> 32) x)); arm_global_pd (arch_state sa) = armKSGlobalPD (ksArchState s'a); arm_hwasid_table (arch_state sa) = armKSHWASIDTable (ksArchState s'a); arm_global_pts (arch_state sa) = armKSGlobalPTs (ksArchState s'a); arm_next_asid (arch_state sa) = armKSNextASID (ksArchState s'a); arm_asid_map (arch_state sa) = armKSASIDMap (ksArchState s'a); arm_kernel_vspace (arch_state sa) = armKSKernelVSpace (ksArchState s'a); interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s'a); cur_thread sa = ksCurThread s'a; idle_thread sa = ksIdleThread s'a; machine_state sa = ksMachineState s'a; work_units_completed sa = ksWorkUnitsCompleted s'a; domain_index sa = ksDomScheduleIdx s'a; domain_list sa = ksDomSchedule s'a; cur_domain sa = ksCurDomain s'a; domain_time sa = ksDomainTime s'a; UCAST(7 \<rightarrow> 32) x = UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2); n < size x\<rbrakk> \<Longrightarrow> x !! n = asid_high_bits_of word2 !! n
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets asid_table \<lbrace>\<lambda>asid_table _. True\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets (\<lambda>a. armKSASIDTable (ksArchState a)) \<lbrace>\<lambda>asidTable _. True\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa asidTable sa s'a x n. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pspace_relation (kheap sa) (ksPSpace s'a); ekheap_relation (ekheap sa) (ksPSpace s'a); sched_act_relation (scheduler_action sa) (ksSchedulerAction s'a); ready_queues_relation (ready_queues sa) (ksReadyQueues s'a); ghost_relation (kheap sa) (gsUserPages s'a) (gsCNodes s'a); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s'a); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s'a); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s'a); asid_table sa = (\<lambda>x. armKSASIDTable (ksArchState s'a) (UCAST(7 \<rightarrow> 32) x)); arm_global_pd (arch_state sa) = armKSGlobalPD (ksArchState s'a); arm_hwasid_table (arch_state sa) = armKSHWASIDTable (ksArchState s'a); arm_global_pts (arch_state sa) = armKSGlobalPTs (ksArchState s'a); arm_next_asid (arch_state sa) = armKSNextASID (ksArchState s'a); arm_asid_map (arch_state sa) = armKSASIDMap (ksArchState s'a); arm_kernel_vspace (arch_state sa) = armKSKernelVSpace (ksArchState s'a); interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s'a); cur_thread sa = ksCurThread s'a; idle_thread sa = ksIdleThread s'a; machine_state sa = ksMachineState s'a; work_units_completed sa = ksWorkUnitsCompleted s'a; domain_index sa = ksDomScheduleIdx s'a; domain_list sa = ksDomSchedule s'a; cur_domain sa = ksCurDomain s'a; domain_time sa = ksDomainTime s'a; n < size x; \<forall>n. UCAST(7 \<rightarrow> 32) x !! n = UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) !! n\<rbrakk> \<Longrightarrow> x !! n = asid_high_bits_of word2 !! n
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets asid_table \<lbrace>\<lambda>asid_table _. True\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets (\<lambda>a. armKSASIDTable (ksArchState a)) \<lbrace>\<lambda>asidTable _. True\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa asidTable sa s'a x n. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pspace_relation (kheap sa) (ksPSpace s'a); ekheap_relation (ekheap sa) (ksPSpace s'a); sched_act_relation (scheduler_action sa) (ksSchedulerAction s'a); ready_queues_relation (ready_queues sa) (ksReadyQueues s'a); ghost_relation (kheap sa) (gsUserPages s'a) (gsCNodes s'a); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) sa) (cdt sa) (ctes_of s'a); cdt_list_relation (cdt_list sa) (cdt sa) (ctes_of s'a); revokable_relation (is_original_cap sa) (null_filter (caps_of_state sa)) (ctes_of s'a); asid_table sa = (\<lambda>x. armKSASIDTable (ksArchState s'a) (UCAST(7 \<rightarrow> 32) x)); arm_global_pd (arch_state sa) = armKSGlobalPD (ksArchState s'a); arm_hwasid_table (arch_state sa) = armKSHWASIDTable (ksArchState s'a); arm_global_pts (arch_state sa) = armKSGlobalPTs (ksArchState s'a); arm_next_asid (arch_state sa) = armKSNextASID (ksArchState s'a); arm_asid_map (arch_state sa) = armKSASIDMap (ksArchState s'a); arm_kernel_vspace (arch_state sa) = armKSKernelVSpace (ksArchState s'a); interrupt_state_relation (interrupt_irq_node sa) (interrupt_states sa) (ksInterruptState s'a); cur_thread sa = ksCurThread s'a; idle_thread sa = ksIdleThread s'a; machine_state sa = ksMachineState s'a; work_units_completed sa = ksWorkUnitsCompleted s'a; domain_index sa = ksDomScheduleIdx s'a; domain_list sa = ksDomSchedule s'a; cur_domain sa = ksCurDomain s'a; domain_time sa = ksDomainTime s'a; n < size x; UCAST(7 \<rightarrow> 32) x !! n = UCAST(7 \<rightarrow> 32) (asid_high_bits_of word2) !! n\<rbrakk> \<Longrightarrow> x !! n = asid_high_bits_of word2 !! n
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets asid_table \<lbrace>\<lambda>asid_table _. True\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets (\<lambda>a. armKSASIDTable (ksArchState a)) \<lbrace>\<lambda>asidTable _. True\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets asid_table \<lbrace>\<lambda>asid_table _. True\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); word2 && mask local.asid_low_bits = 0; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; word1 && mask pageBits = 0; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) yd ()\<rbrace> gets (\<lambda>a. armKSASIDTable (ksArchState a)) \<lbrace>\<lambda>asidTable _. True\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () yd\<rbrace> cap_insert (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) (aa, ba) (a, b) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q153 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd y and (\<lambda>s. is_aligned word2 local.asid_low_bits)\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) () () ()\<rbrace> cteInsert (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) (cte_map (aa, ba)) (cte_map (a, b)) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q'151 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa yd c\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>c. valid_objs and pspace_distinct and pspace_aligned and valid_mdb and valid_list and K ((aa, ba) \<noteq> (a, b)) and cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) and K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) and (\<lambda>s. cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s) and ?Q129 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and ?Q'125 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc c\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
A total of 14 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>rv s. valid_objs s \<and> pspace_distinct s \<and> pspace_aligned s \<and> valid_mdb s \<and> valid_list s \<and> K ((aa, ba) \<noteq> (a, b)) s \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) s \<and> K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) s \<and> cte_wp_at (safe_parent_for (cdt s) (aa, ba) (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) (aa, ba) s \<and> True \<and> True \<and> is_aligned word2 local.asid_low_bits\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (10 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>r sa. valid_objs sa \<and> pspace_distinct sa \<and> pspace_aligned sa \<and> valid_mdb sa \<and> valid_list sa \<and> K ((aa, ba) \<noteq> (a, b)) sa \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) sa \<and> K (is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2))) sa \<and> (cte_wp_at (\<lambda>cap. cap = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) sa \<and> descendants_of (aa, ba) (cdt sa) = {} \<and> valid_objs sa) \<and> True \<and> True \<and> is_aligned word2 local.asid_low_bits\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (10 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()\<rbrace> retype_region word1 (Suc 0) 0 (ArchObject ASIDPoolObj) False \<lbrace>\<lambda>r sa. invs sa \<and> valid_list sa \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>c. c = cap.NullCap) (a, b) sa \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> cte_wp_at (\<lambda>cap. cap = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) sa \<and> descendants_of (aa, ba) (cdt sa) = {}\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>c. pspace_distinct' and pspace_aligned' and valid_mdb' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) and K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and (\<lambda>s. safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) and (\<lambda>a. True \<and> True)\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and ?Q92 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (9 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>rv s. pspace_distinct' s \<and> pspace_aligned' s \<and> valid_mdb' s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) s \<and> K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) s \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s \<and> safe_parent_for' (ctes_of s) (cte_map (aa, ba)) (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> True \<and> True\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and (\<lambda>c. (invs and caps_no_overlap word1 pageBits and pspace_no_overlap (up_aligned_area word1 pageBits) and caps_overlap_reserved {word1..word1 + word_of_nat (Suc 0) * 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} and region_in_kernel_window {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> cap_is_device c = False) slot s) and K (ArchObject ASIDPoolObj = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < 0) and K (range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) and K (ArchObject ASIDPoolObj \<noteq> ArchObject PageDirectoryObj)) c \<and> valid_list c \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> (cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> descendants_of (aa, ba) (cdt c) = {})\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (9 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yb yc. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa; dc yb yc\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>r sa. valid_pspace' sa \<and> valid_pspace' sa \<and> valid_pspace' sa \<and> valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) sa \<and> K (is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) sa \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> descendants_of' (cte_map (aa, ba)) (ctes_of sa) = {} \<and> valid_pspace' sa) \<and> True \<and> True\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and (\<lambda>c. (invs and caps_no_overlap word1 pageBits and pspace_no_overlap (up_aligned_area word1 pageBits) and caps_overlap_reserved {word1..word1 + word_of_nat (Suc 0) * 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} and region_in_kernel_window {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> cap_is_device c = False) slot s) and K (ArchObject ASIDPoolObj = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < 0) and K (range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) and K (ArchObject ASIDPoolObj \<noteq> ArchObject PageDirectoryObj)) c \<and> valid_list c \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> (cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> descendants_of (aa, ba) (cdt c) = {})\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (9 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>r sa. valid_pspace' sa \<and> valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) sa \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) sa \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> descendants_of' (cte_map (aa, ba)) (ctes_of sa) = {}\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and (\<lambda>c. (invs and caps_no_overlap word1 pageBits and pspace_no_overlap (up_aligned_area word1 pageBits) and caps_overlap_reserved {word1..word1 + word_of_nat (Suc 0) * 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} and region_in_kernel_window {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> cap_is_device c = False) slot s) and K (ArchObject ASIDPoolObj = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < 0) and K (range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) and K (ArchObject ASIDPoolObj \<noteq> ArchObject PageDirectoryObj)) c \<and> valid_list c \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> (cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> descendants_of (aa, ba) (cdt c) = {})\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and ?Q'94 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (12 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> makeObjectKO (?dev375 word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa) (Inl (KOArch (KOASIDPool undefined))) = Some (KOArch (KOASIDPool makeObject))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> Suc 0 \<noteq> 0
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0)
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?P'371 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>rv s. valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) s \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and (\<lambda>c. (invs and caps_no_overlap word1 pageBits and pspace_no_overlap (up_aligned_area word1 pageBits) and caps_overlap_reserved {word1..word1 + word_of_nat (Suc 0) * 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} and region_in_kernel_window {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> cap_is_device c = False) slot s) and K (ArchObject ASIDPoolObj = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < 0) and K (range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) and K (ArchObject ASIDPoolObj \<noteq> ArchObject PageDirectoryObj)) c \<and> valid_list c \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> (cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> descendants_of (aa, ba) (cdt c) = {})\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and (\<lambda>c. (pspace_no_overlap' word1 pageBits c \<and> valid_pspace' c \<and> caps_no_overlap'' word1 pageBits c \<and> caps_overlap_reserved' {word1..word1 + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} c \<and> word1 \<noteq> 0) \<and> ?P'371 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc c)\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
A total of 12 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject))) (Suc 0)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?P'371 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>rv s. valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) s \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and (\<lambda>c. (invs and caps_no_overlap word1 pageBits and pspace_no_overlap (up_aligned_area word1 pageBits) and caps_overlap_reserved {word1..word1 + word_of_nat (Suc 0) * 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} and region_in_kernel_window {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> cap_is_device c = False) slot s) and K (ArchObject ASIDPoolObj = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < 0) and K (range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) and K (ArchObject ASIDPoolObj \<noteq> ArchObject PageDirectoryObj)) c \<and> valid_list c \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> (cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> descendants_of (aa, ba) (cdt c) = {})\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and (\<lambda>c. (pspace_no_overlap' word1 pageBits c \<and> valid_pspace' c \<and> caps_no_overlap'' word1 pageBits c \<and> caps_overlap_reserved' {word1..word1 + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} c \<and> word1 \<noteq> 0) \<and> ?P'371 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc c)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 10. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (9 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; pcapa = capability.UntypedCap False word1 pageBits idxa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?P'371 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>rv s. valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) s \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and (\<lambda>c. (invs and caps_no_overlap word1 pageBits and pspace_no_overlap (up_aligned_area word1 pageBits) and caps_overlap_reserved {word1..word1 + word_of_nat (Suc 0) * 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} and region_in_kernel_window {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> cap_is_device c = False) slot s) and K (ArchObject ASIDPoolObj = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < 0) and K (range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) and K (ArchObject ASIDPoolObj \<noteq> ArchObject PageDirectoryObj)) c \<and> valid_list c \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> (cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> descendants_of (aa, ba) (cdt c) = {})\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and (\<lambda>c. (pspace_no_overlap' word1 pageBits c \<and> valid_pspace' c \<and> caps_no_overlap'' word1 pageBits c \<and> caps_overlap_reserved' {word1..word1 + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} c \<and> word1 \<noteq> 0) \<and> ?P'371 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc c)\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (9 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; capAligned (capability.UntypedCap False word1 pageBits idx); valid_untyped' False word1 pageBits idx s'; word1 \<noteq> 0; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'371 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>rv s. capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> asid_pool_at' word1 s \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s \<and> cte_wp_at' (\<lambda>cte. cteCap cte = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and (\<lambda>c. (invs and caps_no_overlap word1 pageBits and pspace_no_overlap (up_aligned_area word1 pageBits) and caps_overlap_reserved {word1..word1 + word_of_nat (Suc 0) * 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} and region_in_kernel_window {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> cap_is_device c = False) slot s) and K (ArchObject ASIDPoolObj = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < 0) and K (range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) and K (ArchObject ASIDPoolObj \<noteq> ArchObject PageDirectoryObj)) c \<and> valid_list c \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> (cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> descendants_of (aa, ba) (cdt c) = {})\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and (\<lambda>c. (pspace_no_overlap' word1 pageBits c \<and> valid_pspace' c \<and> caps_no_overlap'' word1 pageBits c \<and> caps_overlap_reserved' {word1..word1 + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} c \<and> word1 \<noteq> 0) \<and> ?P'371 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc c)\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (9 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; capAligned (capability.UntypedCap False word1 pageBits idx); valid_untyped' False word1 pageBits idx s'; word1 \<noteq> 0; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'405 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>rv s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and (\<lambda>c. (invs and caps_no_overlap word1 pageBits and pspace_no_overlap (up_aligned_area word1 pageBits) and caps_overlap_reserved {word1..word1 + word_of_nat (Suc 0) * 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} and region_in_kernel_window {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> cap_is_device c = False) slot s) and K (ArchObject ASIDPoolObj = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < 0) and K (range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) and K (ArchObject ASIDPoolObj \<noteq> ArchObject PageDirectoryObj)) c \<and> valid_list c \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> (cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> descendants_of (aa, ba) (cdt c) = {})\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and (\<lambda>c. (pspace_no_overlap' word1 pageBits c \<and> valid_pspace' c \<and> caps_no_overlap'' word1 pageBits c \<and> caps_overlap_reserved' {word1..word1 + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} c \<and> word1 \<noteq> 0) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (koTypeOf (KOArch (KOASIDPool makeObject)) = ArchT ASIDPoolT \<and> is_aligned word1 (objBitsKO (KOArch (KOASIDPool makeObject))) \<and> pspace_aligned' c \<and> pspace_no_overlap' word1 (objBitsKO (KOArch (KOASIDPool makeObject))) c) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) c \<and> pspace_no_overlap' word1 pageBits c) \<and> (range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) c \<and> pspace_no_overlap' word1 pageBits c) \<and> ?P'405 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc c)\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (9 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; capAligned (capability.UntypedCap False word1 pageBits idx); valid_untyped' False word1 pageBits idx s'; word1 \<noteq> 0; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'405 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa) (capability.UntypedCap False word1 pageBits idxa) ()\<rbrace> createObjects' word1 (Suc 0) (KOArch (KOASIDPool makeObject)) 0 \<lbrace>\<lambda>rv s. descendants_of' (cte_map (aa, ba)) (null_filter' (ctes_of s)) = {}\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and (\<lambda>c. (invs and caps_no_overlap word1 pageBits and pspace_no_overlap (up_aligned_area word1 pageBits) and caps_overlap_reserved {word1..word1 + word_of_nat (Suc 0) * 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} and region_in_kernel_window {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> cap_is_device c = False) slot s) and K (ArchObject ASIDPoolObj = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < 0) and K (range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) and K (ArchObject ASIDPoolObj \<noteq> ArchObject PageDirectoryObj)) c \<and> valid_list c \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> (cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> descendants_of (aa, ba) (cdt c) = {})\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and (\<lambda>c. (pspace_no_overlap' word1 pageBits c \<and> valid_pspace' c \<and> caps_no_overlap'' word1 pageBits c \<and> caps_overlap_reserved' {word1..word1 + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} c \<and> word1 \<noteq> 0) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (koTypeOf (KOArch (KOASIDPool makeObject)) = ArchT ASIDPoolT \<and> is_aligned word1 (objBitsKO (KOArch (KOASIDPool makeObject))) \<and> pspace_aligned' c \<and> pspace_no_overlap' word1 (objBitsKO (KOArch (KOASIDPool makeObject))) c) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) c \<and> pspace_no_overlap' word1 pageBits c) \<and> (range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) c \<and> pspace_no_overlap' word1 pageBits c) \<and> ?P'405 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc c)\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (8 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap\<rbrace> set_cap (max_free_index_update pcap) (aa, ba) \<lbrace>\<lambda>yb. (\<lambda>a. valid_pspace a \<and> pspace_no_overlap (up_aligned_area word1 (obj_bits_api (ArchObject ASIDPoolObj) 0)) a \<and> valid_mdb a \<and> valid_etcbs a \<and> valid_list a) and (\<lambda>c. (invs and caps_no_overlap word1 pageBits and pspace_no_overlap (up_aligned_area word1 pageBits) and caps_overlap_reserved {word1..word1 + word_of_nat (Suc 0) * 2 ^ obj_bits_api (ArchObject ASIDPoolObj) 0 - 1} and region_in_kernel_window {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} and (\<lambda>s. \<exists>slot. cte_wp_at (\<lambda>c. up_aligned_area word1 pageBits \<subseteq> cap_range c \<and> cap_is_device c = False) slot s) and K (ArchObject ASIDPoolObj = Structures_A.apiobject_type.CapTableObject \<longrightarrow> 0 < 0) and K (range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) and K (ArchObject ASIDPoolObj \<noteq> ArchObject PageDirectoryObj)) c \<and> valid_list c \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> (cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> valid_pspace c \<and> range_cover word1 pageBits (obj_bits_api (ArchObject ASIDPoolObj) 0) (Suc 0)) \<and> descendants_of (aa, ba) (cdt c) = {})\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and (\<lambda>c. (pspace_no_overlap' word1 pageBits c \<and> valid_pspace' c \<and> caps_no_overlap'' word1 pageBits c \<and> caps_overlap_reserved' {word1..word1 + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} c \<and> word1 \<noteq> 0) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (koTypeOf (KOArch (KOASIDPool makeObject)) = ArchT ASIDPoolT \<and> is_aligned word1 (objBitsKO (KOArch (KOASIDPool makeObject))) \<and> pspace_aligned' c \<and> pspace_no_overlap' word1 (objBitsKO (KOArch (KOASIDPool makeObject))) c) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) c \<and> pspace_no_overlap' word1 pageBits c) \<and> (range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) c \<and> pspace_no_overlap' word1 pageBits c) \<and> descendants_of' (cte_map (aa, ba)) (null_filter' (ctes_of c)) = {} \<and> makeObjectKO (?dev415 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc) (Inl (KOArch (KOASIDPool undefined))) = Some (KOArch (KOASIDPool makeObject)) \<and> range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> pspace_no_overlap' word1 pageBits c)\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (8 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa)\<rbrace> set_cap (cap.UntypedCap False word1 pageBits (max_free_index pageBits)) (aa, ba) \<lbrace>\<lambda>yb x. invs x \<and> valid_mdb x \<and> valid_pspace x \<and> caps_no_overlap word1 pageBits x \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs x \<and> valid_list x \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt x) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) x \<and> caps_overlap_reserved {word1..word1 + 2 ^ pageBits - 1} x \<and> region_in_kernel_window {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} x \<and> cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) x \<and> pspace_no_overlap (up_aligned_area word1 pageBits) x \<and> (\<exists>a b. cte_wp_at (\<lambda>c. \<not> cap_is_device c \<and> up_aligned_area word1 pageBits \<subseteq> cap_range c) (a, b) x)\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and (\<lambda>c. (pspace_no_overlap' word1 pageBits c \<and> valid_pspace' c \<and> caps_no_overlap'' word1 pageBits c \<and> caps_overlap_reserved' {word1..word1 + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} c \<and> word1 \<noteq> 0) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (koTypeOf (KOArch (KOASIDPool makeObject)) = ArchT ASIDPoolT \<and> is_aligned word1 (objBitsKO (KOArch (KOASIDPool makeObject))) \<and> pspace_aligned' c \<and> pspace_no_overlap' word1 (objBitsKO (KOArch (KOASIDPool makeObject))) c) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) c \<and> pspace_no_overlap' word1 pageBits c) \<and> (range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) c \<and> pspace_no_overlap' word1 pageBits c) \<and> descendants_of' (cte_map (aa, ba)) (null_filter' (ctes_of c)) = {} \<and> makeObjectKO (?dev415 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc) (Inl (KOArch (KOASIDPool undefined))) = Some (KOArch (KOASIDPool makeObject)) \<and> range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> pspace_no_overlap' word1 pageBits c)\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (8 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa)\<rbrace> set_cap (cap.UntypedCap False word1 pageBits (max_free_index pageBits)) (aa, ba) \<lbrace>\<lambda>r sa. invs sa \<and> caps_no_overlap word1 pageBits sa \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs sa \<and> valid_list sa \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt sa) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> caps_overlap_reserved {word1..word1 + 2 ^ pageBits - 1} sa \<and> region_in_kernel_window {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} sa \<and> cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) sa \<and> pspace_no_overlap (up_aligned_area word1 pageBits) sa \<and> (\<exists>a b. cte_wp_at (\<lambda>c. \<not> cap_is_device c \<and> up_aligned_area word1 pageBits \<subseteq> cap_range c) (a, b) sa)\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and (\<lambda>c. (pspace_no_overlap' word1 pageBits c \<and> valid_pspace' c \<and> caps_no_overlap'' word1 pageBits c \<and> caps_overlap_reserved' {word1..word1 + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} c \<and> word1 \<noteq> 0) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (koTypeOf (KOArch (KOASIDPool makeObject)) = ArchT ASIDPoolT \<and> is_aligned word1 (objBitsKO (KOArch (KOASIDPool makeObject))) \<and> pspace_aligned' c \<and> pspace_no_overlap' word1 (objBitsKO (KOArch (KOASIDPool makeObject))) c) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) c \<and> pspace_no_overlap' word1 pageBits c) \<and> (range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) c \<and> pspace_no_overlap' word1 pageBits c) \<and> descendants_of' (cte_map (aa, ba)) (null_filter' (ctes_of c)) = {} \<and> makeObjectKO (?dev415 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc) (Inl (KOArch (KOASIDPool undefined))) = Some (KOArch (KOASIDPool makeObject)) \<and> range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> pspace_no_overlap' word1 pageBits c)\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (8 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa () () (cap.UntypedCap False word1 pageBits idxa)\<rbrace> set_cap (cap.UntypedCap False word1 pageBits (max_free_index pageBits)) (aa, ba) \<lbrace>\<lambda>r sa. invs sa \<and> caps_no_overlap word1 pageBits sa \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs sa \<and> valid_list sa \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt sa) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> caps_overlap_reserved {word1..word1 + 2 ^ pageBits - 1} sa \<and> (\<forall>x\<in>{word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state sa) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) sa \<and> pspace_no_overlap (up_aligned_area word1 pageBits) sa \<and> (\<exists>a b. cte_wp_at (\<lambda>c. \<not> cap_is_device c \<and> up_aligned_area word1 pageBits \<subseteq> cap_range c) (a, b) sa)\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>yc. (\<lambda>a. pspace_aligned' a \<and> pspace_distinct' a \<and> pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) a \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val)) and (\<lambda>c. (pspace_no_overlap' word1 pageBits c \<and> valid_pspace' c \<and> caps_no_overlap'' word1 pageBits c \<and> caps_overlap_reserved' {word1..word1 + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} c \<and> word1 \<noteq> 0) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (koTypeOf (KOArch (KOASIDPool makeObject)) = ArchT ASIDPoolT \<and> is_aligned word1 (objBitsKO (KOArch (KOASIDPool makeObject))) \<and> pspace_aligned' c \<and> pspace_no_overlap' word1 (objBitsKO (KOArch (KOASIDPool makeObject))) c) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) c \<and> pspace_no_overlap' word1 pageBits c) \<and> (range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) c \<and> pspace_no_overlap' word1 pageBits c) \<and> descendants_of' (cte_map (aa, ba)) (null_filter' (ctes_of c)) = {} \<and> makeObjectKO (?dev415 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa yc) (Inl (KOArch (KOASIDPool undefined))) = Some (KOArch (KOASIDPool makeObject)) \<and> range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' c \<and> pspace_distinct' c \<and> pspace_no_overlap' word1 pageBits c)\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and ?Q82 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and ?Q'84 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (7 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya; cap_relation pcap pcapa; pcap = cap.UntypedCap False word1 pageBits idxa\<rbrakk> \<Longrightarrow> \<lbrace>?P'501 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index (capBlockSize pcapa)) \<lbrace>\<lambda>rv sa. pspace_no_overlap' word1 (obj_bits_api (ArchObject ASIDPoolObj) 0) sa \<and> (\<exists>val. KOArch (KOASIDPool makeObject) = injectKO val) \<and> (pspace_no_overlap' word1 pageBits sa \<and> valid_pspace' sa \<and> caps_no_overlap'' word1 pageBits sa \<and> caps_overlap_reserved' {word1..word1 + word_of_nat (Suc 0 * 2 ^ 0 * 2 ^ objBitsKO (KOArch (KOASIDPool makeObject))) - 1} sa \<and> word1 \<noteq> 0) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (koTypeOf (KOArch (KOASIDPool makeObject)) = ArchT ASIDPoolT \<and> is_aligned word1 (objBitsKO (KOArch (KOASIDPool makeObject))) \<and> pspace_aligned' sa \<and> pspace_no_overlap' word1 (objBitsKO (KOArch (KOASIDPool makeObject))) sa) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> pspace_no_overlap' word1 pageBits sa) \<and> (range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> pspace_no_overlap' word1 pageBits sa) \<and> descendants_of' (cte_map (aa, ba)) (null_filter' (ctes_of sa)) = {} \<and> makeObjectKO (?dev415 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcap pcapa rv) (Inl (KOArch (KOASIDPool undefined))) = Some (KOArch (KOASIDPool makeObject)) \<and> range_cover word1 pageBits (objBitsKO (KOArch (KOASIDPool makeObject)) + 0) (Suc 0) \<and> Suc 0 \<noteq> 0 \<and> pspace_aligned' sa \<and> pspace_distinct' sa \<and> pspace_no_overlap' word1 pageBits sa\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and (\<lambda>c. (descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> invs c \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> cap_is_device c = False) (aa, ba) c \<and> max_free_index pageBits \<le> 2 ^ pageBits) \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap False word1 pageBits (max_free_index pageBits))) (aa, ba) and caps_no_overlap word1 pageBits) c \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs c \<and> valid_list c \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt c) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> ((\<lambda>s. if (a, b) = (aa, ba) then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) s) and cte_wp_at (\<lambda>_. True) (aa, ba)) c \<and> (invs c \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> usable_untyped_range (cap.UntypedCap False word1 pageBits (max_free_index pageBits)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) c \<and> cte_wp_at ((=) pcap) (aa, ba) c) \<and> (\<forall>x\<in>{word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state c) x = ArmVSpaceKernelWindow) \<and> ((\<lambda>s. if (aa, ba) = (aa, ba) then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.UntypedCap False word1 pageBits (2 ^ pageBits) else cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) s) and cte_wp_at (\<lambda>_. True) (aa, ba)) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> True) and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and (\<lambda>sa. pspace_aligned' sa \<and> pspace_distinct' sa \<and> ?P'501 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa sa)\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (7 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'501 word1 a b aa ba word2 s s' cte ctea idx idxa () () (capability.UntypedCap False word1 pageBits idxa)\<rbrace> updateFreeIndex (cte_map (aa, ba)) (max_free_index pageBits) \<lbrace>\<lambda>r sa. invs' sa \<and> word1 \<noteq> 0 \<and> pspace_no_overlap' word1 pageBits sa \<and> caps_no_overlap'' word1 pageBits sa \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> descendants_of' (cte_map (aa, ba)) (null_filter' (ctes_of sa)) = {} \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> caps_overlap_reserved' {word1..word1 + 2 ^ pageBits - 1} sa \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) and valid_objs and pspace_aligned and pspace_distinct and (\<lambda>c. (descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> invs c \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> cap_is_device c = False) (aa, ba) c \<and> max_free_index pageBits \<le> 2 ^ pageBits) \<and> (cte_wp_at (\<lambda>c. untyped_range c = untyped_range (cap.UntypedCap False word1 pageBits (max_free_index pageBits))) (aa, ba) and caps_no_overlap word1 pageBits) c \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs c \<and> valid_list c \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt c) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> ((\<lambda>s. if (a, b) = (aa, ba) then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) s) and cte_wp_at (\<lambda>_. True) (aa, ba)) c \<and> (invs c \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> {word1..word1 + 2 ^ pageBits - 1} \<and> usable_untyped_range (cap.UntypedCap False word1 pageBits (max_free_index pageBits)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) c \<and> cte_wp_at ((=) pcap) (aa, ba) c) \<and> (\<forall>x\<in>{word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state c) x = ArmVSpaceKernelWindow) \<and> ((\<lambda>s. if (aa, ba) = (aa, ba) then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.UntypedCap False word1 pageBits (2 ^ pageBits) else cte_wp_at (\<lambda>a. a = cap.UntypedCap False word1 pageBits (2 ^ pageBits)) (aa, ba) s) and cte_wp_at (\<lambda>_. True) (aa, ba)) c \<and> pspace_no_overlap (up_aligned_area word1 pageBits) c \<and> True) and (\<lambda>s. pcap = cap.UntypedCap False word1 pageBits idxa)\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and (\<lambda>sa. pspace_aligned' sa \<and> pspace_distinct' sa \<and> ?P'501 word1 a b aa ba word2 s s' cte ctea idx idxa y ya pcapa sa)\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (6 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa ()\<rbrace> get_cap (aa, ba) \<lbrace>\<lambda>pcap s. cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update pcap) \<and> cap_bits c = cap_bits (max_free_index_update pcap) \<and> cap_is_device c = cap_is_device (max_free_index_update pcap)) (aa, ba) s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) s \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs s \<and> valid_list s \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt s) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) s) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> invs s \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) s \<and> cte_wp_at ((=) pcap) (aa, ba) s \<and> (\<forall>x\<in>{word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state s) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> pcap = cap.UntypedCap False word1 pageBits idxa\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa y ya. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace> getSlotCap (cte_map (aa, ba)) \<lbrace>\<lambda>pcapa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> word1 \<noteq> 0) \<and> (pspace_no_overlap' word1 pageBits s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (caps_no_overlap'' word1 pageBits s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> cte_wp_at' (if cte_map (aa, ba) = cte_map (a, b) then (\<lambda>a. cteCap a = capability.NullCap) \<circ> cteCap_update (capFreeIndex_update (K (max_free_index pageBits))) else (\<lambda>a. cteCap a = capability.NullCap)) (cte_map (a, b)) s) \<and> (valid_pspace' s \<and> descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (aa, ba)) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map (aa, ba)) s) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> cte_wp_at' (if cte_map (aa, ba) = cte_map (aa, ba) then (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) \<circ> cteCap_update (capFreeIndex_update (K (max_free_index pageBits))) else (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits))) (cte_map (aa, ba)) s)\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>y. cte_wp_at (\<lambda>_. True) (aa, ba) and ?Q68 word1 a b aa ba word2 s s' cte ctea idx idxa y\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and ?Q'69 word1 a b aa ba word2 s s' cte ctea idx idxa ya\<rbrace>
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and ?Q58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'593 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>rv s. \<forall>cap. cte_wp_at ((=) cap) (aa, ba) s \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update cap) \<and> cap_bits c = cap_bits (max_free_index_update cap) \<and> cap_is_device c = cap_is_device (max_free_index_update cap)) (aa, ba) s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) s \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs s \<and> valid_list s \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt s) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) s) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> invs s \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) s \<and> cte_wp_at ((=) cap) (aa, ba) s \<and> (\<forall>x\<in>{word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state s) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cap = cap.UntypedCap False word1 pageBits idxa\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> word1 \<noteq> 0) \<and> (pspace_no_overlap' word1 pageBits s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (caps_no_overlap'' word1 pageBits s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> cte_wp_at' (if cte_map (aa, ba) = cte_map (a, b) then (\<lambda>a. cteCap a = capability.NullCap) \<circ> cteCap_update (capFreeIndex_update (K (max_free_index pageBits))) else (\<lambda>a. cteCap a = capability.NullCap)) (cte_map (a, b)) s) \<and> (valid_pspace' s \<and> descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (aa, ba)) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map (aa, ba)) s) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> cte_wp_at' (if cte_map (aa, ba) = cte_map (aa, ba) then (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) \<circ> cteCap_update (capFreeIndex_update (K (max_free_index pageBits))) else (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits))) (cte_map (aa, ba)) s))\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and (\<lambda>sa. (cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> fst (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1}) \<and> ?P'593 word1 a b aa ba word2 s s' cte ctea idx idxa sa)) sa
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (5 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; word1 && ~~ mask pageBits = word1 \<and> pageBits \<le> word_bits \<and> word_size_bits \<le> pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'593 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>rv s. \<forall>cap. cte_wp_at ((=) cap) (aa, ba) s \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update cap) \<and> cap_bits c = cap_bits (max_free_index_update cap) \<and> cap_is_device c = cap_is_device (max_free_index_update cap)) (aa, ba) s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) s \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs s \<and> valid_list s \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt s) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) s) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> invs s \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) s \<and> cte_wp_at ((=) cap) (aa, ba) s \<and> (\<forall>x\<in>{word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state s) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cap = cap.UntypedCap False word1 pageBits idxa\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> word1 && ~~ mask pageBits = word1 \<and> pageBits \<le> word_bits \<and> word_size_bits \<le> pageBits
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> word1 \<noteq> 0) \<and> (pspace_no_overlap' word1 pageBits s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (caps_no_overlap'' word1 pageBits s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> cte_wp_at' (if cte_map (aa, ba) = cte_map (a, b) then (\<lambda>a. cteCap a = capability.NullCap) \<circ> cteCap_update (capFreeIndex_update (K (max_free_index pageBits))) else (\<lambda>a. cteCap a = capability.NullCap)) (cte_map (a, b)) s) \<and> (valid_pspace' s \<and> descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (aa, ba)) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map (aa, ba)) s) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> cte_wp_at' (if cte_map (aa, ba) = cte_map (aa, ba) then (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) \<circ> cteCap_update (capFreeIndex_update (K (max_free_index pageBits))) else (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits))) (cte_map (aa, ba)) s))\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and (\<lambda>sa. (cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> fst (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1}) \<and> ?P'593 word1 a b aa ba word2 s s' cte ctea idx idxa sa)) sa
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (5 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> word1 && ~~ mask pageBits = word1 \<and> pageBits \<le> word_bits \<and> word_size_bits \<le> pageBits
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; word1 && ~~ mask pageBits = word1 \<and> pageBits \<le> word_bits \<and> word_size_bits \<le> pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'593 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>rv s. \<forall>cap. cte_wp_at ((=) cap) (aa, ba) s \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update cap) \<and> cap_bits c = cap_bits (max_free_index_update cap) \<and> cap_is_device c = cap_is_device (max_free_index_update cap)) (aa, ba) s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) s \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs s \<and> valid_list s \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt s) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) s) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> invs s \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) s \<and> cte_wp_at ((=) cap) (aa, ba) s \<and> (\<forall>x\<in>{word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state s) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cap = cap.UntypedCap False word1 pageBits idxa\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> word1 \<noteq> 0) \<and> (pspace_no_overlap' word1 pageBits s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (caps_no_overlap'' word1 pageBits s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> cte_wp_at' (if cte_map (aa, ba) = cte_map (a, b) then (\<lambda>a. cteCap a = capability.NullCap) \<circ> cteCap_update (capFreeIndex_update (K (max_free_index pageBits))) else (\<lambda>a. cteCap a = capability.NullCap)) (cte_map (a, b)) s) \<and> (valid_pspace' s \<and> descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (aa, ba)) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map (aa, ba)) s) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> cte_wp_at' (if cte_map (aa, ba) = cte_map (aa, ba) then (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) \<circ> cteCap_update (capFreeIndex_update (K (max_free_index pageBits))) else (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits))) (cte_map (aa, ba)) s))\<rbrace>
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and (\<lambda>sa. (cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> fst (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1}) \<and> ?P'593 word1 a b aa ba word2 s s' cte ctea idx idxa sa)) sa
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; word1 && ~~ mask pageBits = word1 \<and> pageBits \<le> word_bits \<and> word_size_bits \<le> pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'593 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> delete_objects word1 pageBits \<lbrace>\<lambda>rv s. \<forall>cap. cte_wp_at ((=) cap) (aa, ba) s \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update cap) \<and> cap_bits c = cap_bits (max_free_index_update cap) \<and> cap_is_device c = cap_is_device (max_free_index_update cap)) (aa, ba) s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> invs s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) s \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs s \<and> valid_list s \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt s) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) s) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> invs s \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) s \<and> cte_wp_at ((=) cap) (aa, ba) s \<and> (\<forall>x\<in>{word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state s) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap (up_aligned_area word1 pageBits) s \<and> cap = cap.UntypedCap False word1 pageBits idxa\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> word1 \<noteq> 0) \<and> (pspace_no_overlap' word1 pageBits s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (caps_no_overlap'' word1 pageBits s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> cte_wp_at' (if cte_map (aa, ba) = cte_map (a, b) then (\<lambda>a. cteCap a = capability.NullCap) \<circ> cteCap_update (capFreeIndex_update (K (max_free_index pageBits))) else (\<lambda>a. cteCap a = capability.NullCap)) (cte_map (a, b)) s) \<and> (valid_pspace' s \<and> descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (aa, ba)) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map (aa, ba)) s) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> cte_wp_at' (if cte_map (aa, ba) = cte_map (aa, ba) then (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) \<circ> cteCap_update (capFreeIndex_update (K (max_free_index pageBits))) else (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits))) (cte_map (aa, ba)) s))\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and (\<lambda>sa. (cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> fst (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1}) \<and> ?P'593 word1 a b aa ba word2 s s' cte ctea idx idxa sa)) sa
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; word1 && ~~ mask pageBits = word1 \<and> pageBits \<le> word_bits \<and> word_size_bits \<le> pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'593 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> do y <- modify (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits});
modify (detype {word1..word1 + 2 ^ pageBits - 1})
od \<lbrace>\<lambda>rv s. \<forall>cap. cte_wp_at ((=) cap) (aa, ba) s \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update cap) \<and> cap_bits c = cap_bits (max_free_index_update cap) \<and> cap_is_device c = cap_is_device (max_free_index_update cap)) (aa, ba) s \<and> valid_objs s \<and> pspace_aligned s \<and> pspace_distinct s \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) s \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} s \<and> invs s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) s \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) s \<and> caps_no_overlap word1 pageBits s \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs s \<and> valid_list s \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt s) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) s) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> invs s \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) s \<and> cte_wp_at ((=) cap) (aa, ba) s \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state s) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) s \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} s \<and> cap = cap.UntypedCap False word1 pageBits idxa\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya. pspace_distinct' and pspace_aligned' and (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> word1 \<noteq> 0) \<and> (pspace_no_overlap' word1 pageBits s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (caps_no_overlap'' word1 pageBits s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> cte_wp_at' (if cte_map (aa, ba) = cte_map (a, b) then (\<lambda>a. cteCap a = capability.NullCap) \<circ> cteCap_update (capFreeIndex_update (K (max_free_index pageBits))) else (\<lambda>a. cteCap a = capability.NullCap)) (cte_map (a, b)) s) \<and> (valid_pspace' s \<and> descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (aa, ba)) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map (aa, ba)) s) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> cte_wp_at' (if cte_map (aa, ba) = cte_map (aa, ba) then (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) \<circ> cteCap_update (capFreeIndex_update (K (max_free_index pageBits))) else (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits))) (cte_map (aa, ba)) s))\<rbrace>
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and (\<lambda>sa. (cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> fst (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1}) \<and> ?P'593 word1 a b aa ba word2 s s' cte ctea idx idxa sa)) sa
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya s. pspace_distinct' s \<and> pspace_aligned' s \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) and pspace_distinct' and pspace_aligned' and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> (invs' s \<and> cte_wp_at' ((\<lambda>cap. isUntypedCap cap \<and> capFreeIndex cap \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize cap \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits) \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> word1 \<noteq> 0) \<and> (pspace_no_overlap' word1 pageBits s \<and> valid_pspace' s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (caps_no_overlap'' word1 pageBits s \<and> cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2))) \<and> (cte_wp_at' (isUntypedCap \<circ> cteCap) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> cte_wp_at' (if cte_map (aa, ba) = cte_map (a, b) then (\<lambda>a. cteCap a = capability.NullCap) \<circ> cteCap_update (capFreeIndex_update (K (max_free_index pageBits))) else (\<lambda>a. cteCap a = capability.NullCap)) (cte_map (a, b)) s) \<and> (valid_pspace' s \<and> descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (aa, ba)) (ctes_of s) \<and> cte_wp_at' ((\<lambda>cap. {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange cap \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) cap) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> isUntypedCap cap) \<circ> cteCap) (cte_map (aa, ba)) s) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> cte_wp_at' (if cte_map (aa, ba) = cte_map (aa, ba) then (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) \<circ> cteCap_update (capFreeIndex_update (K (max_free_index pageBits))) else (\<lambda>a. cteCap a = capability.UntypedCap False word1 pageBits (2 ^ pageBits))) (cte_map (aa, ba)) s)) s\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and (\<lambda>s. (cte_wp_at (\<lambda>a. True) (aa, ba) s \<and> fst (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1}) \<and> (\<forall>cap. cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update cap) \<and> cap_bits c = cap_bits (max_free_index_update cap) \<and> cap_is_device c = cap_is_device (max_free_index_update cap)) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cap = cap.UntypedCap False word1 pageBits idxa))) sa
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>ya s. invs' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> valid_pspace' s \<and> word1 \<noteq> 0 \<and> pspace_no_overlap' word1 pageBits s \<and> caps_no_overlap'' word1 pageBits s \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {} \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) s \<and> descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (aa, ba)) (ctes_of s) \<and> cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. max_free_index pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap a)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) s\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and (\<lambda>s. (cte_wp_at (\<lambda>a. True) (aa, ba) s \<and> fst (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1}) \<and> (\<forall>cap. cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update cap) \<and> cap_bits c = cap_bits (max_free_index_update cap) \<and> cap_is_device c = cap_is_device (max_free_index_update cap)) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cap = cap.UntypedCap False word1 pageBits idxa))) sa
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>r sa. invs' sa \<and> word1 \<noteq> 0 \<and> pspace_no_overlap' word1 pageBits sa \<and> caps_no_overlap'' word1 pageBits sa \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> descendants_of' (cte_map (aa, ba)) (ctes_of sa) = {} \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (aa, ba)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. max_free_index pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and (\<lambda>s. (cte_wp_at (\<lambda>a. True) (aa, ba) s \<and> fst (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1}) \<and> (\<forall>cap. cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update cap) \<and> cap_bits c = cap_bits (max_free_index_update cap) \<and> cap_is_device c = cap_is_device (max_free_index_update cap)) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cap = cap.UntypedCap False word1 pageBits idxa))) sa
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and ?Q'58 word1 a b aa ba word2 s s' cte ctea idx idxa) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'629 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>rv s. caps_no_overlap'' word1 pageBits s \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {} \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) s \<and> descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (aa, ba)) (ctes_of s) \<and> cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. max_free_index pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap a)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) s\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and (\<lambda>s. (cte_wp_at (\<lambda>a. True) (aa, ba) s \<and> fst (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1}) \<and> (\<forall>cap. cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update cap) \<and> cap_bits c = cap_bits (max_free_index_update cap) \<and> cap_is_device c = cap_is_device (max_free_index_update cap)) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cap = cap.UntypedCap False word1 pageBits idxa))) sa
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> ?P'629 word1 a b aa ba word2 s s' cte ctea idx idxa sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; capAligned (capability.UntypedCap False word1 pageBits idx); valid_untyped' False word1 pageBits idx s'; word1 \<noteq> 0; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'629 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>rv s. caps_no_overlap'' word1 pageBits s \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {} \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) s \<and> descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (aa, ba)) (ctes_of s) \<and> cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. max_free_index pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap a)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) s\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and (\<lambda>s. (cte_wp_at (\<lambda>a. True) (aa, ba) s \<and> fst (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1}) \<and> (\<forall>cap. cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update cap) \<and> cap_bits c = cap_bits (max_free_index_update cap) \<and> cap_is_device c = cap_is_device (max_free_index_update cap)) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cap = cap.UntypedCap False word1 pageBits idxa))) sa
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> ?P'629 word1 a b aa ba word2 s s' cte ctea idx idxa sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; capAligned (capability.UntypedCap False word1 pageBits idx); valid_untyped' False word1 pageBits idx s'; word1 \<noteq> 0; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'645 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {} \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) s \<and> descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (aa, ba)) (ctes_of s) \<and> cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. max_free_index pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (word_of_nat (max_free_index pageBits)) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> max_free_index pageBits \<and> max_free_index pageBits \<le> 2 ^ capBlockSize (cteCap a)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. max_free_index pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) s\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and (\<lambda>s. (cte_wp_at (\<lambda>a. True) (aa, ba) s \<and> fst (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1}) \<and> (\<forall>cap. cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update cap) \<and> cap_bits c = cap_bits (max_free_index_update cap) \<and> cap_is_device c = cap_is_device (max_free_index_update cap)) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cap = cap.UntypedCap False word1 pageBits idxa))) sa
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> ?P'645 word1 a b aa ba word2 s s' cte ctea idx idxa sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; capAligned (capability.UntypedCap False word1 pageBits idx); valid_untyped' False word1 pageBits idx s'; word1 \<noteq> 0; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'645 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) s \<and> descendants_of' (cte_map (aa, ba)) (ctes_of s) = {} \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) s \<and> descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (aa, ba)) (ctes_of s) \<and> cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) s \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) s\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and (\<lambda>s. (cte_wp_at (\<lambda>a. True) (aa, ba) s \<and> fst (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1}) \<and> (\<forall>cap. cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update cap) \<and> cap_bits c = cap_bits (max_free_index_update cap) \<and> cap_is_device c = cap_is_device (max_free_index_update cap)) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cap = cap.UntypedCap False word1 pageBits idxa))) sa
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> ?P'645 word1 a b aa ba word2 s s' cte ctea idx idxa sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; capAligned (capability.UntypedCap False word1 pageBits idx); valid_untyped' False word1 pageBits idx s'; word1 \<noteq> 0; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; idx \<le> 2 ^ pageBits; is_aligned (word_of_nat idx) minUntypedSizeBits\<rbrakk> \<Longrightarrow> \<lbrace>?P'645 word1 a b aa ba word2 s s' cte ctea idx idxa\<rbrace> deleteObjects word1 pageBits \<lbrace>\<lambda>r sa. cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> descendants_of' (cte_map (aa, ba)) (ctes_of sa) = {} \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> descendants_of' (cte_map (aa, ba)) (ctes_of sa) = {} \<and> cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa\<rbrace>
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and (\<lambda>s. (cte_wp_at (\<lambda>a. True) (aa, ba) s \<and> fst (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1}) \<and> (\<forall>cap. cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update cap) \<and> cap_bits c = cap_bits (max_free_index_update cap) \<and> cap_is_device c = cap_is_device (max_free_index_update cap)) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cap = cap.UntypedCap False word1 pageBits idxa))) sa
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> ?P'645 word1 a b aa ba word2 s s' cte ctea idx idxa sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. einvs sa \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa) \<and> (\<exists>cref. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa))) cref sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) cref sa) \<and> untyped_children_in_mdb sa \<and> if_unsafe_then_cap sa \<and> valid_mdb sa \<and> valid_global_refs sa \<and> ct_active sa) and (\<lambda>s. (cte_wp_at (\<lambda>a. True) (aa, ba) s \<and> fst (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1}) \<and> (\<forall>cap. cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (max_free_index_update cap) \<and> cap_bits c = cap_bits (max_free_index_update cap) \<and> cap_is_device c = cap_is_device (max_free_index_update cap)) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> max_free_index pageBits \<le> 2 ^ pageBits \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> valid_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (if a = aa \<and> b = ba then cap.UntypedCap False word1 pageBits (max_free_index pageBits) = cap.NullCap else cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (if max_free_index pageBits < 2 ^ pageBits then {word1 + word_of_nat (max_free_index pageBits)..word1 + 2 ^ pageBits - 1} else {}) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {} \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cte_wp_at ((=) cap) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s))) x = ArmVSpaceKernelWindow) \<and> max_free_index pageBits = 2 ^ pageBits \<and> cte_wp_at (\<lambda>_. True) (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} s)) \<and> cap = cap.UntypedCap False word1 pageBits idxa))) sa
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d686 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx686 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d690 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx690 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d692 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx692 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d696 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx696 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d698 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx698 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d699 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx699 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> (a = aa \<and> b = ba \<longrightarrow> sa \<turnstile> cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa))) (a, b) sa \<and> descendants_range (cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa)) (a, b) sa) \<and> if_unsafe_then_cap sa \<and> valid_global_refs sa \<and> cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<and> ((\<exists>cap. cte_wp_at ((=) cap) (aa, ba) sa) \<longrightarrow> word1 \<le> aa \<and> aa \<le> word1 + 2 ^ pageBits - 1)) \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa) \<and> (\<exists>ab bb. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa))) (ab, bb) sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa)) (ab, bb) sa) \<and> if_unsafe_then_cap sa \<and> valid_global_refs sa \<and> cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<and> (\<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d686 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx686 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d690 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx690 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d692 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx692 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d696 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx696 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d698 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx698 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d699 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx699 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (?x711 word1 a b aa ba word2 s' cte ctea idx idxa sa) (?y711 word1 a b aa ba word2 s' cte ctea idx idxa sa) sa\<rbrakk> \<Longrightarrow> (a = aa \<and> b = ba \<longrightarrow> sa \<turnstile> cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa))) (a, b) sa \<and> descendants_range (cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa)) (a, b) sa) \<and> if_unsafe_then_cap sa \<and> valid_global_refs sa \<and> cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<and> ((\<exists>cap. cte_wp_at ((=) cap) (aa, ba) sa) \<longrightarrow> word1 \<le> aa \<and> aa \<le> word1 + 2 ^ pageBits - 1)) \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa) \<and> (\<exists>ab bb. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa))) (ab, bb) sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa)) (ab, bb) sa) \<and> if_unsafe_then_cap sa \<and> valid_global_refs sa \<and> cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<and> (\<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa)
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> detype_locale (?x711 word1 a b aa ba word2 s' cte ctea idx idxa sa) (?y711 word1 a b aa ba word2 s' cte ctea idx idxa sa) sa
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d686 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx686 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d690 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx690 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d692 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx692 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d696 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx696 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d698 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx698 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d699 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx699 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> detype_locale (?x711 word1 a b aa ba word2 s' cte ctea idx idxa sa) (?y711 word1 a b aa ba word2 s' cte ctea idx idxa sa) sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (?x711 word1 a b aa ba word2 s' cte ctea idx idxa sa) (?y711 word1 a b aa ba word2 s' cte ctea idx idxa sa) sa\<rbrakk> \<Longrightarrow> (a = aa \<and> b = ba \<longrightarrow> sa \<turnstile> cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa))) (a, b) sa \<and> descendants_range (cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa)) (a, b) sa) \<and> if_unsafe_then_cap sa \<and> valid_global_refs sa \<and> cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<and> ((\<exists>cap. cte_wp_at ((=) cap) (aa, ba) sa) \<longrightarrow> word1 \<le> aa \<and> aa \<le> word1 + 2 ^ pageBits - 1)) \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa) \<and> (\<exists>ab bb. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa))) (ab, bb) sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa)) (ab, bb) sa) \<and> if_unsafe_then_cap sa \<and> valid_global_refs sa \<and> cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<and> (\<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa)
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d686 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx686 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d690 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx690 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d692 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx692 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d696 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx696 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d698 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx698 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d699 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx699 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (?x711 word1 a b aa ba word2 s' cte ctea idx idxa sa)) (?y711 word1 a b aa ba word2 s' cte ctea idx idxa sa) sa \<and> is_untyped_cap (?x711 word1 a b aa ba word2 s' cte ctea idx idxa sa) \<and> descendants_range (?x711 word1 a b aa ba word2 s' cte ctea idx idxa sa) (?y711 word1 a b aa ba word2 s' cte ctea idx idxa sa) sa \<and> untyped_children_in_mdb sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (?x711 word1 a b aa ba word2 s' cte ctea idx idxa sa) (?y711 word1 a b aa ba word2 s' cte ctea idx idxa sa) sa\<rbrakk> \<Longrightarrow> (a = aa \<and> b = ba \<longrightarrow> sa \<turnstile> cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa))) (a, b) sa \<and> descendants_range (cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa)) (a, b) sa) \<and> if_unsafe_then_cap sa \<and> valid_global_refs sa \<and> cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<and> ((\<exists>cap. cte_wp_at ((=) cap) (aa, ba) sa) \<longrightarrow> word1 \<le> aa \<and> aa \<le> word1 + 2 ^ pageBits - 1)) \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa) \<and> (\<exists>ab bb. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa))) (ab, bb) sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa)) (ab, bb) sa) \<and> if_unsafe_then_cap sa \<and> valid_global_refs sa \<and> cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<and> (\<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa)
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d686 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx686 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d690 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx690 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d692 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx692 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d696 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx696 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d698 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx698 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d699 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx699 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> (a = aa \<and> b = ba \<longrightarrow> sa \<turnstile> cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa))) (a, b) sa \<and> descendants_range (cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa)) (a, b) sa) \<and> if_unsafe_then_cap sa \<and> valid_global_refs sa \<and> cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<and> ((\<exists>cap. cte_wp_at ((=) cap) (aa, ba) sa) \<longrightarrow> word1 \<le> aa \<and> aa \<le> word1 + 2 ^ pageBits - 1)) \<and> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa) \<and> (\<exists>ab bb. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa))) (ab, bb) sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa)) (ab, bb) sa) \<and> if_unsafe_then_cap sa \<and> valid_global_refs sa \<and> cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<and> (\<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d686 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx686 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d690 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx690 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d692 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx692 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d696 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx696 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d698 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx698 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d699 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx699 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (9 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> a = aa \<and> b = ba \<longrightarrow> sa \<turnstile> cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) \<and> (\<exists>a b. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa))) (a, b) sa \<and> descendants_range (cap.UntypedCap (?d63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 aa ba aa ba word2 sa s' cte ctea idx idxa)) (a, b) sa) \<and> if_unsafe_then_cap sa \<and> valid_global_refs sa \<and> cte_wp_at (\<lambda>a. True) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<and> ((\<exists>cap. cte_wp_at ((=) cap) (aa, ba) sa) \<longrightarrow> word1 \<le> aa \<and> aa \<le> word1 + 2 ^ pageBits - 1)
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa)
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> \<exists>ab bb. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa))) (ab, bb) sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa)) (ab, bb) sa
 4. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> if_unsafe_then_cap sa
 5. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> valid_global_refs sa
 6. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>a. True) (aa, ba) sa
 7. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1
 8. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 9. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d686 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx686 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d690 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx690 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d692 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx692 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d696 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx696 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d698 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx698 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d699 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx699 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (8 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> sa \<turnstile> cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa)
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> \<exists>ab bb. cte_wp_at ((=) (cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa))) (ab, bb) sa \<and> descendants_range (cap.UntypedCap (?d63 word1 a b aa ba word2 sa s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 sa s' cte ctea idx idxa)) (ab, bb) sa
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> if_unsafe_then_cap sa
 4. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> valid_global_refs sa
 5. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>a. True) (aa, ba) sa
 6. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1
 7. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 8. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>sa. valid_cap' (capability.UntypedCap (?d63 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx63 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d686 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx686 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d690 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx690 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d692 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx692 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d696 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx696 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d698 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx698 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d699 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx699 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (7 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> \<exists>a b. cte_wp_at ((=) (cap.UntypedCap False word1 pageBits idxa)) (a, b) sa \<and> descendants_range (cap.UntypedCap False word1 pageBits idxa) (a, b) sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> if_unsafe_then_cap sa
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> valid_global_refs sa
 4. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>a. True) (aa, ba) sa
 5. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1
 6. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d686 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx686 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d690 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx690 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d692 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx692 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d696 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx696 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d698 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx698 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d699 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx699 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i = asid_control_invocation.MakePool word1_ (a_, b_) (aa_, ba_) word2_; i' = asidcontrol_invocation.MakePool word1_ (cte_map (a_, b_)) (cte_map (aa_, ba_)) word2_; (sa_, s'_) \<in> state_relation; invs sa_; invs' s'_; valid_list sa_; ct_active' s'_; valid_sched sa_; ct_active sa_; ctes_of s'_ (cte_map (a_, b_)) = Some cte_; cteCap cte_ = capability.NullCap; caps_of_state sa_ (a_, b_) = Some cap.NullCap; descendants_of' (cte_map (aa_, ba_)) (ctes_of s'_) = {}; ctes_of s'_ (cte_map (aa_, ba_)) = Some ctea_; cteCap ctea_ = capability.UntypedCap False word1_ pageBits idx_; cap_table_at (length b_) a_ sa_; cte_map (a_, b_) \<noteq> cte_map (aa_, ba_); ex_cte_cap_wp_to is_cnode_cap (a_, b_) sa_; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a_, b_)) s'_; sch_act_simple s'_; a_ = aa_ \<longrightarrow> b_ \<noteq> ba_; descendants_of (aa_, ba_) (cdt sa_) = {}; caps_of_state sa_ (aa_, ba_) = Some (cap.UntypedCap False word1_ pageBits idxa_); is_aligned word2_ local.asid_low_bits; word2_ < 2 ^ local.asid_bits; asid_table sa_ (asid_high_bits_of word2_) = None; valid_cap' (capability.UntypedCap False word1_ pageBits idx_) s'_; is_aligned word1_ pageBits; detype_locale (cap.UntypedCap False word1_ pageBits idxa_) (aa_, ba_) sa_\<rbrakk> \<Longrightarrow> \<exists>a b. cte_wp_at ((=) (cap.UntypedCap False word1_ pageBits idxa_)) (a, b) sa_ \<and> descendants_range (cap.UntypedCap False word1_ pageBits idxa_) (a, b) sa_ proof (prove)
goal (6 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> if_unsafe_then_cap sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> valid_global_refs sa
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>a. True) (aa, ba) sa
 4. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1
 5. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d626 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx626 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d628 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx628 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?d630 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx630 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?d642 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx642 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d686 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx686 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d688 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx688 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d690 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx690 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d692 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx692 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d694 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx694 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d696 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx696 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d698 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx698 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?d699 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx699 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (5 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> if_unsafe_then_cap sa &&& valid_global_refs sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>a. True) (aa, ba) sa
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1
 4. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (1 subgoal):
 1. if_unsafe_then_cap sa_ &&& valid_global_refs sa_ proof (prove)
using this:
i = asid_control_invocation.MakePool word1_ (a_, b_) (aa_, ba_) word2_
i' = asidcontrol_invocation.MakePool word1_ (cte_map (a_, b_)) (cte_map (aa_, ba_)) word2_
(sa_, s'_) \<in> state_relation
invs sa_
invs' s'_
valid_list sa_
ct_active' s'_
valid_sched sa_
ct_active sa_
ctes_of s'_ (cte_map (a_, b_)) = Some cte_
cteCap cte_ = capability.NullCap
caps_of_state sa_ (a_, b_) = Some cap.NullCap
descendants_of' (cte_map (aa_, ba_)) (ctes_of s'_) = {}
ctes_of s'_ (cte_map (aa_, ba_)) = Some ctea_
cteCap ctea_ = capability.UntypedCap False word1_ pageBits idx_
cap_table_at (length b_) a_ sa_
cte_map (a_, b_) \<noteq> cte_map (aa_, ba_)
ex_cte_cap_wp_to is_cnode_cap (a_, b_) sa_
ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a_, b_)) s'_
sch_act_simple s'_
a_ = aa_ \<longrightarrow> b_ \<noteq> ba_
descendants_of (aa_, ba_) (cdt sa_) = {}
caps_of_state sa_ (aa_, ba_) = Some (cap.UntypedCap False word1_ pageBits idxa_)
is_aligned word2_ local.asid_low_bits
word2_ < 2 ^ local.asid_bits
asid_table sa_ (asid_high_bits_of word2_) = None
valid_cap' (capability.UntypedCap False word1_ pageBits idx_) s'_
is_aligned word1_ pageBits
detype_locale (cap.UntypedCap False word1_ pageBits idxa_) (aa_, ba_) sa_

goal (1 subgoal):
 1. if_unsafe_then_cap sa_ &&& valid_global_refs sa_ proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>a. True) (aa, ba) sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits\<rbrakk> \<Longrightarrow> cte_wp_at ((\<noteq>) cap.NullCap) (?p5 word1 a b aa ba word2 s' cte ctea idx idxa sa) sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; fst (?p5 word1 a b aa ba word2 s' cte ctea idx idxa sa) \<notin> untyped_range (cap.UntypedCap False word1 pageBits idxa)\<rbrakk> \<Longrightarrow> word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; fst (aa, ba) \<notin> untyped_range (cap.UntypedCap False word1 pageBits idxa)\<rbrakk> \<Longrightarrow> word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (7 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> untyped_children_in_mdb sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> ct_active sa
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa)) (aa, ba) sa
 4. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> is_untyped_cap (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa)
 5. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> descendants_range (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa) (aa, ba) sa
 6. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; (invs and untyped_children_in_mdb) (detype (untyped_range (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa)) (clear_um (untyped_range (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa)) sa))\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (6 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> ct_active sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa)) (aa, ba) sa
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> is_untyped_cap (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa)
 4. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> descendants_range (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa) (aa, ba) sa
 5. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; (invs and untyped_children_in_mdb) (detype (untyped_range (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa)) (clear_um (untyped_range (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa)) sa))\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (5 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa)) (aa, ba) sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> is_untyped_cap (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa)
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> descendants_range (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa) (aa, ba) sa
 4. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; (invs and untyped_children_in_mdb) (detype (untyped_range (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa)) (clear_um (untyped_range (?cap16 word1 a b aa ba word2 s' cte ctea idx idxa sa)) sa))\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> is_untyped_cap (cap.UntypedCap False word1 pageBits idxa)
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> descendants_range (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; (invs and untyped_children_in_mdb) (detype (untyped_range (cap.UntypedCap False word1 pageBits idxa)) (clear_um (untyped_range (cap.UntypedCap False word1 pageBits idxa)) sa))\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa\<rbrakk> \<Longrightarrow> descendants_range (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; (invs and untyped_children_in_mdb) (detype (untyped_range (cap.UntypedCap False word1 pageBits idxa)) (clear_um (untyped_range (cap.UntypedCap False word1 pageBits idxa)) sa))\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; (invs and untyped_children_in_mdb) (detype (untyped_range (cap.UntypedCap False word1 pageBits idxa)) (clear_um (untyped_range (cap.UntypedCap False word1 pageBits idxa)) sa))\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; (invs and untyped_children_in_mdb) (detype (untyped_range (cap.UntypedCap False word1 pageBits idxa)) (clear_um (untyped_range (cap.UntypedCap False word1 pageBits idxa)) sa))\<rbrakk> \<Longrightarrow> pageBits \<le> LENGTH(32)
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; (invs and untyped_children_in_mdb) (detype (untyped_range (cap.UntypedCap False word1 pageBits idxa)) (clear_um (untyped_range (cap.UntypedCap False word1 pageBits idxa)) sa)); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; (invs and untyped_children_in_mdb) (detype (untyped_range (cap.UntypedCap False word1 pageBits idxa)) (clear_um (untyped_range (cap.UntypedCap False word1 pageBits idxa)) sa)); {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}\<rbrakk> \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) (aa, ba) sa \<and> (word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1) \<longrightarrow> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> obj_ref_of c = obj_ref_of (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_bits c = cap_bits (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap) \<and> cap_is_device c = cap_is_device (free_index_update (\<lambda>_. 2 ^ untyped_sz_bits cap) cap)) (aa, ba) sa \<and> valid_objs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_aligned (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_distinct (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = pageBits \<and> obj_ref_of c = word1 \<and> \<not> cap_is_device c) (aa, ba) sa \<and> cte_wp_at (\<lambda>c. untyped_range c = {word1..word1 + 2 ^ pageBits - 1}) (aa, ba) sa \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> is_simple_cap (cap.ArchObjectCap (arch_cap.ASIDPoolCap word1 word2)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa))) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> range_cover word1 pageBits pageBits (Suc 0) \<and> descendants_of (aa, ba) (cdt (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> cte_wp_at (\<lambda>a. a = cap.NullCap) (a, b) sa \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) x = ArmVSpaceKernelWindow) \<and> cte_wp_at (\<lambda>_. True) (aa, ba) sa \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1 + word_of_nat k |k. k < 2 ^ pageBits} sa)) \<and> cap = cap.UntypedCap False word1 pageBits idxa
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) = {} \<and> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> (aa = a \<longrightarrow> ba \<noteq> b) \<and> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) = {} \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) = {} \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (7 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (cap.UntypedCap (?dev42 word1 a b aa ba word2 s' cte ctea idx idxa sa) (?ptr42 word1 a b aa ba word2 s' cte ctea idx idxa sa) (?bits42 word1 a b aa ba word2 s' cte ctea idx idxa sa) (?idx42 word1 a b aa ba word2 s' cte ctea idx idxa sa))) (?p'42 word1 a b aa ba word2 s' cte ctea idx idxa sa) sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> descendants_range_in (?S42 word1 a b aa ba word2 s' cte ctea idx idxa sa) (?p'42 word1 a b aa ba word2 s' cte ctea idx idxa sa) sa
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> untyped_children_in_mdb sa
 4. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> ?S42 word1 a b aa ba word2 s' cte ctea idx idxa sa \<subseteq> untyped_range (cap.UntypedCap (?dev42 word1 a b aa ba word2 s' cte ctea idx idxa sa) (?ptr42 word1 a b aa ba word2 s' cte ctea idx idxa sa) (?bits42 word1 a b aa ba word2 s' cte ctea idx idxa sa) (?idx42 word1 a b aa ba word2 s' cte ctea idx idxa sa))
 5. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs sa
 6. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; fst (a, b) \<notin> ?S42 word1 a b aa ba word2 s' cte ctea idx idxa sa\<rbrakk> \<Longrightarrow> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) = {} \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (6 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> descendants_range_in (?S42 word1 a b aa ba word2 s' cte ctea idx idxa sa) (aa, ba) sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> untyped_children_in_mdb sa
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> ?S42 word1 a b aa ba word2 s' cte ctea idx idxa sa \<subseteq> untyped_range (cap.UntypedCap False word1 pageBits idxa)
 4. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs sa
 5. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; fst (a, b) \<notin> ?S42 word1 a b aa ba word2 s' cte ctea idx idxa sa\<rbrakk> \<Longrightarrow> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) = {} \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))
 6. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (5 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> untyped_children_in_mdb sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> ?S42 word1 a b aa ba word2 s' cte ctea idx idxa sa \<subseteq> untyped_range (cap.UntypedCap False word1 pageBits idxa)
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs sa
 4. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; fst (a, b) \<notin> ?S42 word1 a b aa ba word2 s' cte ctea idx idxa sa\<rbrakk> \<Longrightarrow> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) = {} \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))
 5. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> ?S42 word1 a b aa ba word2 s' cte ctea idx idxa sa \<subseteq> untyped_range (cap.UntypedCap False word1 pageBits idxa)
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs sa
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; fst (a, b) \<notin> ?S42 word1 a b aa ba word2 s' cte ctea idx idxa sa\<rbrakk> \<Longrightarrow> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) = {} \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; fst (a, b) \<notin> untyped_range (cap.UntypedCap False word1 pageBits idxa)\<rbrakk> \<Longrightarrow> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) = {} \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; fst (a, b) \<notin> untyped_range (cap.UntypedCap False word1 pageBits idxa)\<rbrakk> \<Longrightarrow> (word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1) \<and> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) = {} \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> descendants_of (aa, ba) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) = {} \<and> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_list_2 (cdt_list (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (detype {word1..word1 + 2 ^ pageBits - 1} (clear_um {word1..word1 + 2 ^ pageBits - 1} sa))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> caps_no_overlap word1 pageBits (detype {word1..word1 + 2 ^ pageBits - 1} sa) \<and> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} sa) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} sa) \<and> valid_list_2 (cdt_list (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (cap.UntypedCap (?dev65 word1 a b aa ba word2 s' cte ctea idx idxa sa) (word1 && ~~ mask pageBits) pageBits (?idx65 word1 a b aa ba word2 s' cte ctea idx idxa sa))) (?cref65 word1 a b aa ba word2 s' cte ctea idx idxa sa) sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> descendants_range_in {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} (?cref65 word1 a b aa ba word2 s' cte ctea idx idxa sa) sa
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} sa) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} sa) \<and> valid_list_2 (cdt_list (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> caps_of_state sa (?cref65 word1 a b aa ba word2 s' cte ctea idx idxa sa) = Some (cap.UntypedCap (?dev65 word1 a b aa ba word2 s' cte ctea idx idxa sa) word1 pageBits (?idx65 word1 a b aa ba word2 s' cte ctea idx idxa sa))
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> descendants_range_in {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} (?cref65 word1 a b aa ba word2 s' cte ctea idx idxa sa) sa
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} sa) \<and> descendants_range_in {word1..word1 + 2 ^ pageBits - 1} (aa, ba) (detype {word1..word1 + 2 ^ pageBits - 1} sa) \<and> valid_list_2 (cdt_list (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> (\<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow) \<and> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} sa) \<and> valid_list_2 (cdt_list (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> \<forall>x\<in>{word1..word1 + 2 ^ pageBits - 1}. arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} sa) \<and> valid_list_2 (cdt_list (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa x. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; word1 \<le> x; x \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} sa) \<and> valid_list_2 (cdt_list (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa x. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; word1 \<le> x; x \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> cap_refs_in_kernel_window sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa x. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; word1 \<le> x; x \<le> word1 + 2 ^ pageBits - 1; \<exists>cap. cap.UntypedCap False word1 pageBits idxa = cap \<and> region_in_kernel_window (cap_range cap) sa\<rbrakk> \<Longrightarrow> arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} sa) \<and> valid_list_2 (cdt_list (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))
 4. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa x. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1; word1 \<le> x; x \<le> word1 + 2 ^ pageBits - 1; \<exists>cap. cap.UntypedCap False word1 pageBits idxa = cap \<and> region_in_kernel_window (cap_range cap) sa\<rbrakk> \<Longrightarrow> arm_kernel_vspace (arch_state (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) x = ArmVSpaceKernelWindow
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} sa) \<and> valid_list_2 (cdt_list (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> pspace_no_overlap {word1..word1 + (2 ^ pageBits - 1)} (detype {word1..word1 + 2 ^ pageBits - 1} sa) \<and> valid_list_2 (cdt_list (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (7 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> invs sa
 2. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> caps_of_state sa (?p90 word1 a b aa ba word2 s' cte ctea idx idxa sa) = Some (cap.UntypedCap (?dev89 word1 a b aa ba word2 s' cte ctea idx idxa sa) word1 pageBits (?idx89 word1 a b aa ba word2 s' cte ctea idx idxa sa))
 3. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> pspace_aligned sa
 4. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_objs sa
 5. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> {word1..word1 + (2 ^ pageBits - 1)} \<subseteq> up_aligned_area word1 pageBits
 6. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_list_2 (cdt_list (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))
 7. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b aa ba word2 s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (sa, s') \<in> state_relation; invs sa; invs' s'; valid_list sa; ct_active' s'; valid_sched sa; ct_active sa; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state sa (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a sa; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) sa; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt sa) = {}; caps_of_state sa (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table sa (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; detype_locale (cap.UntypedCap False word1 pageBits idxa) (aa, ba) sa; {word1 + word_of_nat k |k. k < 2 ^ pageBits} = {word1..word1 + 2 ^ pageBits - 1}; invs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa)); untyped_children_in_mdb (detype {word1..word1 + 2 ^ pageBits - 1} sa); word1 \<le> aa \<longrightarrow> \<not> aa \<le> word1 + 2 ^ pageBits - 1; word1 \<le> a \<longrightarrow> \<not> a \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_list_2 (cdt_list (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))) (cdt (clear_um {word1..word1 + 2 ^ pageBits - 1} sa)) \<and> valid_etcbs (clear_um {word1..word1 + 2 ^ pageBits - 1} (detype {word1..word1 + 2 ^ pageBits - 1} sa))
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, s') \<in> state_relation; invs s; invs' s'; valid_list s; ct_active' s'; valid_sched s; ct_active s; ctes_of s' (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of s') = {}; ctes_of s' (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) s'; sch_act_simple s'; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) s'; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_cap' (capability.UntypedCap False word1 pageBits idxa) s \<and> valid_pspace' s) and (\<lambda>sa. (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. word1 \<noteq> 0) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s s' cte ctea idx idxa)) and valid_pspace') sa \<and> (invs' sa \<and> ct_active' sa \<and> sch_act_simple sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> (cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> cte_map (a, b) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') and invs' and ct_active' and sch_act_simple and (\<lambda>sa. descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s s' cte ctea idx idxa)) (makePoolParent i') (ctes_of sa)) and (\<lambda>s. descendants_of' (cte_map (aa, ba)) (ctes_of s) = {}) and K (pageBits < word_bits \<and> is_aligned word1 pageBits)) sa \<and> (cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> (cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> cte_map (aa, ba) \<notin> {word1..word1 + 2 ^ pageBits - 1} \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s s' cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s s' cte ctea idx idxa)) sa \<and> valid_pspace' sa)) sa proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; (s, sa) \<in> state_relation; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) sa; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> valid_cap' (capability.UntypedCap False word1 pageBits idxa) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> word1 \<noteq> 0 \<and> valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> (word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) sa; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> ctes_of sa (cte_map (aa, ba)) = Some (?cte109 word1 a b aa ba word2 s s' cte ctea idx idxa sa)
 2. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) sa; is_aligned word1 pageBits; s' = sa\<rbrakk> \<Longrightarrow> valid_objs s
 3. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) sa; is_aligned word1 pageBits; s' = sa; \<exists>c slot. cte_wp_at ((=) c) slot s \<and> cap_relation c (cteCap (?cte109 word1 a b aa ba word2 s s' cte ctea idx idxa sa)) \<and> cte_map (aa, ba) = cte_map slot\<rbrakk> \<Longrightarrow> valid_cap' (capability.UntypedCap False word1 pageBits idxa) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> word1 \<noteq> 0 \<and> valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> (word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s s' cte ctea idx idxa sa. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (aa, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (aa, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (aa, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (aa, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) sa; is_aligned word1 pageBits; s' = sa; \<exists>c a b. cte_wp_at ((=) c) (a, b) s \<and> cap_relation c (capability.UntypedCap False word1 pageBits idx) \<and> cte_map (aa, ba) = cte_map (a, b)\<rbrakk> \<Longrightarrow> valid_cap' (capability.UntypedCap False word1 pageBits idxa) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> word1 \<noteq> 0 \<and> valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> (word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) sa \<and> descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (aa, ba)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (aa, ba)) sa \<and> (word1 \<le> cte_map (aa, ba) \<longrightarrow> \<not> cte_map (aa, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s cte ctea idx idxa sa c ab bb. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, bb)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, bb)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, bb)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, bb); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) sa; is_aligned word1 pageBits; cte_wp_at ((=) c) (ab, bb) s; cap_relation c (capability.UntypedCap False word1 pageBits idx); cte_map (aa, ba) = cte_map (ab, bb)\<rbrakk> \<Longrightarrow> valid_cap' (capability.UntypedCap False word1 pageBits idxa) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> word1 \<noteq> 0 \<and> valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> (word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa proof (prove)
goal (6 subgoals):
 1. \<And>word1 a b aa ba word2 s cte ctea idx idxa sa c ab bb. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, bb)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, bb)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, bb)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, bb); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) sa; is_aligned word1 pageBits; cte_wp_at ((=) c) (ab, bb) s; cap_relation c (capability.UntypedCap False word1 pageBits idx)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, ba) (?s119 word1 a b aa ba word2 s cte ctea idx idxa sa c ab bb)
 2. \<And>word1 a b aa ba word2 s cte ctea idx idxa sa c ab bb. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, bb)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, bb)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, bb)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, bb); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) sa; is_aligned word1 pageBits; cte_wp_at ((=) c) (ab, bb) s; cap_relation c (capability.UntypedCap False word1 pageBits idx)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ab, bb) (?s119 word1 a b aa ba word2 s cte ctea idx idxa sa c ab bb)
 3. \<And>word1 a b aa ba word2 s cte ctea idx idxa sa c ab bb. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, bb)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, bb)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, bb)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, bb); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) sa; is_aligned word1 pageBits; cte_wp_at ((=) c) (ab, bb) s; cap_relation c (capability.UntypedCap False word1 pageBits idx)\<rbrakk> \<Longrightarrow> valid_objs (?s119 word1 a b aa ba word2 s cte ctea idx idxa sa c ab bb)
 4. \<And>word1 a b aa ba word2 s cte ctea idx idxa sa c ab bb. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, bb)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, bb)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, bb)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, bb); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) sa; is_aligned word1 pageBits; cte_wp_at ((=) c) (ab, bb) s; cap_relation c (capability.UntypedCap False word1 pageBits idx)\<rbrakk> \<Longrightarrow> pspace_aligned (?s119 word1 a b aa ba word2 s cte ctea idx idxa sa c ab bb)
 5. \<And>word1 a b aa ba word2 s cte ctea idx idxa sa c ab bb. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, bb)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, bb)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, bb)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, bb); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) sa; is_aligned word1 pageBits; cte_wp_at ((=) c) (ab, bb) s; cap_relation c (capability.UntypedCap False word1 pageBits idx)\<rbrakk> \<Longrightarrow> pspace_distinct (?s119 word1 a b aa ba word2 s cte ctea idx idxa sa c ab bb)
 6. \<And>word1 a b aa ba word2 s cte ctea idx idxa sa c ab bb. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, bb)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, bb)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, bb)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, bb); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) sa; is_aligned word1 pageBits; cte_wp_at ((=) c) (ab, bb) s; cap_relation c (capability.UntypedCap False word1 pageBits idx); (aa, ba) = (ab, bb)\<rbrakk> \<Longrightarrow> valid_cap' (capability.UntypedCap False word1 pageBits idxa) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> word1 \<noteq> 0 \<and> valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> (word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b aa ba word2 s cte ctea idx idxa sa c ab bb. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (aa, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, bb)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, bb)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, bb)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idx; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, bb); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = aa \<longrightarrow> b \<noteq> ba; descendants_of (aa, ba) (cdt s) = {}; caps_of_state s (aa, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; valid_cap' (capability.UntypedCap False word1 pageBits idx) sa; is_aligned word1 pageBits; cte_wp_at ((=) c) (ab, bb) s; cap_relation c (capability.UntypedCap False word1 pageBits idx); (aa, ba) = (ab, bb)\<rbrakk> \<Longrightarrow> valid_cap' (capability.UntypedCap False word1 pageBits idxa) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> descendants_range' (capability.UntypedCap (?d3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idx3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?da3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> descendants_range' (capability.UntypedCap (?da3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxa3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> word1 \<noteq> 0 \<and> valid_cap' (capability.UntypedCap (?db3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxb3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dc3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> caps_no_overlap'' word1 pageBits sa \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxc3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dd3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxd3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?de3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> descendants_range' (capability.UntypedCap (?de3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxe3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a)) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?df3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxf3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. cteCap a = capability.NullCap) (cte_map (a, b)) sa \<and> (word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dg3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxg3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?dh3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) sa \<and> descendants_range' (capability.UntypedCap (?dh3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxh3 word1 a b aa ba word2 s sa cte ctea idx idxa)) (cte_map (ab, bb)) (ctes_of sa) \<and> cte_wp_at' (\<lambda>a. capFreeIndex_update (\<lambda>y. 2 ^ pageBits) (cteCap a) = capability.UntypedCap False word1 pageBits (2 ^ pageBits)) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?di3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxi3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> capFreeIndex (cteCap a) \<le> 2 ^ pageBits \<and> pageBits \<le> capBlockSize (cteCap a)) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dj3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxj3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa \<and> cte_wp_at' (\<lambda>a. isUntypedCap (cteCap a) \<and> {word1..word1 + 2 ^ pageBits - 1} \<subseteq> untypedRange (cteCap a) \<and> usableUntypedRange (capFreeIndex_update (\<lambda>_. 2 ^ pageBits) (cteCap a)) \<inter> {word1..word1 + 2 ^ pageBits - 1} = {}) (cte_map (ab, bb)) sa \<and> (word1 \<le> cte_map (ab, bb) \<longrightarrow> \<not> cte_map (ab, bb) \<le> word1 + 2 ^ pageBits - 1) \<and> valid_cap' (capability.UntypedCap (?dk3 word1 a b aa ba word2 s sa cte ctea idx idxa) word1 pageBits (?idxk3 word1 a b aa ba word2 s sa cte ctea idx idxa)) sa \<and> valid_pspace' sa proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; capAligned (capability.UntypedCap False word1 pageBits idxa); valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits\<rbrakk> \<Longrightarrow> caps_no_overlap'' word1 pageBits sa \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> \<not> ?d3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<and> \<not> ?da3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<and> \<not> ?dc3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<and> \<not> ?de3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<and> \<not> ?dh3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<and> idxa = ?idx3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<and> idxa = ?idxa3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<and> idxa = ?idxc3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<and> idxa = ?idxe3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<and> idxa = ?idxh3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<and> is_aligned (word_of_nat (?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> ?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> (word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> capAligned (capability.UntypedCap (?db3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dd3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?df3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dg3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?di3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dj3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dk3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> valid_untyped' (?db3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dd3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?df3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dg3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?di3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dj3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dk3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> descendants_range' (capability.UntypedCap (?d3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idx3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?da3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxa3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?dc3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxc3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?de3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxe3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?dh3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxh3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) (cte_map (ab, ba)) (ctes_of sa) proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; capAligned (capability.UntypedCap False word1 pageBits idxa); valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits\<rbrakk> \<Longrightarrow> caps_no_overlap'' word1 pageBits sa \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> \<not> \<not> True \<and> \<not> \<not> True \<and> \<not> \<not> True \<and> \<not> \<not> True \<and> \<not> \<not> True \<and> True \<and> True \<and> True \<and> True \<and> True \<and> is_aligned (word_of_nat (?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> ?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> (word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> capAligned (capability.UntypedCap (?db3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dd3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?df3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dg3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?di3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dj3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dk3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> valid_untyped' (?db3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dd3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?df3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dg3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?di3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dj3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dk3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> descendants_range' (capability.UntypedCap (?t167 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t166 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?t178 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t177 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?t189 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t188 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?t200 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t199 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?t211 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t210 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa)
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; capAligned (capability.UntypedCap False word1 pageBits idxa); valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits\<rbrakk> \<Longrightarrow> caps_no_overlap'' word1 pageBits sa \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> ?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> (word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> capAligned (capability.UntypedCap (?db3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dd3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?df3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dg3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?di3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dj3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dk3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> valid_untyped' (?db3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dd3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?df3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dg3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?di3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dj3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dk3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> descendants_range' (capability.UntypedCap (?t167 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t166 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?t178 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t177 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?t189 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t188 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?t200 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t199 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?t211 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t210 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa)
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 local.asid_low_bits; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; capAligned (capability.UntypedCap False word1 pageBits idxa); valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' (?S232 word1 a b ba word2 s cte ctea idxa sa ab) (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> caps_no_overlap'' word1 pageBits sa \<and> is_simple_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap word1 word2)) \<and> is_aligned (2 ^ pageBits) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> is_aligned (word_of_nat (?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) minUntypedSizeBits \<and> ?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> ?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa \<le> 2 ^ pageBits \<and> (word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1) \<and> (word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1) \<and> capAligned (capability.UntypedCap (?db3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dd3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?df3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dg3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?di3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dj3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> capAligned (capability.UntypedCap (?dk3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa)) \<and> valid_untyped' (?db3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxb3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dd3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxd3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?df3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxf3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dg3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxg3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?di3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxi3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dj3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxj3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> valid_untyped' (?dk3 word1 a b ab ba word2 s sa cte ctea idxa idxa) word1 pageBits (?idxk3 word1 a b ab ba word2 s sa cte ctea idxa idxa) sa \<and> descendants_range' (capability.UntypedCap (?t167 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t166 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?t178 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t177 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?t189 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t188 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?t200 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t199 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa) \<and> descendants_range' (capability.UntypedCap (?t211 word1 a b ba word2 s cte ctea idxa idxa sa ab \<noteq> ?t210 word1 a b ba word2 s cte ctea idxa idxa sa ab) word1 pageBits idxa) (cte_map (ab, ba)) (ctes_of sa)
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (5 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> caps_no_overlap'' word1 pageBits sa
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> is_aligned word1 12 \<and> 12 < word_bits
 3. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> is_aligned (2 ^ pageBits) minUntypedSizeBits
 4. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1
 5. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (6 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.UntypedCap (?d272 word1 a b ba word2 s cte ctea idxa sa ab) (word1 && ~~ mask pageBits) pageBits (?idx272 word1 a b ba word2 s cte ctea idxa sa ab)) (?cref272 word1 a b ba word2 s cte ctea idxa sa ab) sa
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> descendants_range_in' {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} (?cref272 word1 a b ba word2 s cte ctea idxa sa ab) (ctes_of sa)
 3. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> is_aligned word1 12 \<and> 12 < word_bits
 4. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> is_aligned (2 ^ pageBits) minUntypedSizeBits
 5. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1
 6. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (5 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> descendants_range_in' {word1..(word1 && ~~ mask pageBits) + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> is_aligned word1 12 \<and> 12 < word_bits
 3. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> is_aligned (2 ^ pageBits) minUntypedSizeBits
 4. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1
 5. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> is_aligned word1 12 \<and> 12 < word_bits
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> is_aligned (2 ^ pageBits) minUntypedSizeBits
 3. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1
 4. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> is_aligned (2 ^ pageBits) minUntypedSizeBits
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1
 3. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (4 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> is_aligned (2 ^ pageBits) (?x283 word1 a b ba word2 s cte ctea idxa sa ab)
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> ?x283 word1 a b ba word2 s cte ctea idxa sa ab
 3. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1
 4. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> minUntypedSizeBits \<le> pageBits
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1
 3. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (a, b) \<longrightarrow> \<not> cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); word1 \<le> cte_map (a, b); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> False
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (7 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cteb. cteCap cteb = capability.UntypedCap (?d291 word1 a b ba word2 s cte ctea idxa sa ab) word1 pageBits (?idx291 word1 a b ba word2 s cte ctea idxa sa ab)) (?cref291 word1 a b ba word2 s cte ctea idxa sa ab) (?s291 word1 a b ba word2 s cte ctea idxa sa ab)
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> descendants_of' (?cref291 word1 a b ba word2 s cte ctea idxa sa ab) (ctes_of (?s291 word1 a b ba word2 s cte ctea idxa sa ab)) = {}
 3. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> invs' (?s291 word1 a b ba word2 s cte ctea idxa sa ab)
 4. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) (?s291 word1 a b ba word2 s cte ctea idxa sa ab)
 5. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs' (?s291 word1 a b ba word2 s cte ctea idxa sa ab)
 6. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1; False\<rbrakk> \<Longrightarrow> False
 7. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (6 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> invs' sa
 3. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa
 4. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs' sa
 5. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1; False\<rbrakk> \<Longrightarrow> False
 6. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs' sa
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1; False\<rbrakk> \<Longrightarrow> False
 3. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (a, b) \<le> word1 + 2 ^ pageBits - 1; False\<rbrakk> \<Longrightarrow> False
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa)\<rbrakk> \<Longrightarrow> word1 \<le> cte_map (ab, ba) \<longrightarrow> \<not> cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); word1 \<le> cte_map (ab, ba); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> False
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (6 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cteb. cteCap cteb = capability.UntypedCap (?d312 word1 a b ba word2 s cte ctea idxa sa ab) word1 pageBits (?idx312 word1 a b ba word2 s cte ctea idxa sa ab)) (?cref312 word1 a b ba word2 s cte ctea idxa sa ab) (?s312 word1 a b ba word2 s cte ctea idxa sa ab)
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> descendants_of' (?cref312 word1 a b ba word2 s cte ctea idxa sa ab) (ctes_of (?s312 word1 a b ba word2 s cte ctea idxa sa ab)) = {}
 3. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> invs' (?s312 word1 a b ba word2 s cte ctea idxa sa ab)
 4. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ab, ba)) (?s312 word1 a b ba word2 s cte ctea idxa sa ab)
 5. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs' (?s312 word1 a b ba word2 s cte ctea idxa sa ab)
 6. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1; False\<rbrakk> \<Longrightarrow> False
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (5 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> invs' sa
 3. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ab, ba)) sa
 4. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs' sa
 5. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1; False\<rbrakk> \<Longrightarrow> False
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (3 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (ab, ba)) sa
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs' sa
 3. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1; False\<rbrakk> \<Longrightarrow> False
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (2 subgoals):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1\<rbrakk> \<Longrightarrow> valid_global_refs' sa
 2. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1; False\<rbrakk> \<Longrightarrow> False
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal (1 subgoal):
 1. \<And>word1 a b ba word2 s cte ctea idxa sa ab. \<lbrakk>i = asid_control_invocation.MakePool word1 (a, b) (ab, ba) word2; i' = asidcontrol_invocation.MakePool word1 (cte_map (a, b)) (cte_map (ab, ba)) word2; invs s; invs' sa; valid_list s; ct_active' sa; valid_sched s; ct_active s; ctes_of sa (cte_map (a, b)) = Some cte; cteCap cte = capability.NullCap; caps_of_state s (a, b) = Some cap.NullCap; descendants_of' (cte_map (ab, ba)) (ctes_of sa) = {}; ctes_of sa (cte_map (ab, ba)) = Some ctea; cteCap ctea = capability.UntypedCap False word1 pageBits idxa; cap_table_at (length b) a s; cte_map (a, b) \<noteq> cte_map (ab, ba); ex_cte_cap_wp_to is_cnode_cap (a, b) s; ex_cte_cap_wp_to' (\<lambda>_. True) (cte_map (a, b)) sa; sch_act_simple sa; a = ab \<longrightarrow> b \<noteq> ba; descendants_of (ab, ba) (cdt s) = {}; caps_of_state s (ab, ba) = Some (cap.UntypedCap False word1 pageBits idxa); is_aligned word2 10; word2 < 2 ^ local.asid_bits; asid_table s (asid_high_bits_of word2) = None; is_aligned word1 pageBits; minUntypedSizeBits \<le> pageBits; pageBits \<le> maxUntypedSizeBits; is_aligned (word_of_nat idxa) minUntypedSizeBits; word1 \<noteq> 0; valid_untyped' False word1 pageBits idxa sa; idxa \<le> 2 ^ pageBits; descendants_range_in' {word1..word1 + 2 ^ pageBits - 1} (cte_map (ab, ba)) (ctes_of sa); cte_map (ab, ba) \<le> word1 + 2 ^ pageBits - 1; False\<rbrakk> \<Longrightarrow> False
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa proof (prove)
goal:
No subgoals!
flex-flex pairs:
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t211 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t210 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t200 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t199 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t189 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t188 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t178 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t177 word1 a b ba word2 s cte ctea idxa idxa
\<lambda>word1 a b ba word2 s cte ctea idxa. ?t167 word1 a b ba word2 s cte ctea idxa idxa \<equiv>\<^sup>? \<lambda>word1 a b ba word2 s cte ctea idxa. ?t166 word1 a b ba word2 s cte ctea idxa idxa