theory CSpace_C

lemma Arch_sameRegionAs_spec:
  "\<forall>capa capb. \<Gamma> \<turnstile> \<lbrace>  ccap_relation (ArchObjectCap capa) \<acute>cap_a \<and>
                 ccap_relation (ArchObjectCap capb) \<acute>cap_b  \<rbrace>
  Call Arch_sameRegionAs_'proc
  \<lbrace>  \<acute>ret__unsigned_long = from_bool (Arch.sameRegionAs capa capb) \<rbrace>" supply if_cong[cong] apply vcg apply clarsimp apply (simp add: ARM_H.sameRegionAs_def) subgoal for capa capb cap_b cap_a apply (cases capa; simp add: cap_get_tag_isCap_unfolded_H_cap isCap_simps)

  \<comment> \<open>capa is ASIDPoolCap\<close> apply (cases capb;
             simp add: cap_get_tag_isCap_unfolded_H_cap isCap_simps cap_tag_defs)
      \<comment> \<open>capb is also ASIDPoolCap\<close> apply (frule cap_get_tag_isCap_unfolded_H_cap(13)[where cap'=cap_a]) apply (frule cap_get_tag_isCap_unfolded_H_cap(13)[where cap'=cap_b]) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (simp add: ccap_relation_def  map_option_case) apply (simp add: cap_asid_pool_cap_lift) apply (simp add: cap_to_H_def) apply (cases "capASIDPool_CL (cap_asid_pool_cap_lift cap_a) =
                        capASIDPool_CL (cap_asid_pool_cap_lift cap_b)"; simp)

      \<comment> \<open>capb is ASIDControlCap\<close> subgoal for \<dots> vmpage_size option apply clarsimp apply (cases "vmpage_size=ARMSmallPage") apply (frule cap_get_tag_isCap_unfolded_H_cap(16)[where cap'=cap_b],
              assumption, simp add: cap_tag_defs) apply (frule cap_get_tag_isCap_unfolded_H_cap(17)[where cap'=cap_b],
             assumption, simp add: cap_tag_defs) done

  \<comment> \<open>capa is ASIDControlCap\<close> apply (cases capb;
            simp add: cap_get_tag_isCap_unfolded_H_cap isCap_simps cap_tag_defs)
     \<comment> \<open>capb is PageCap\<close> subgoal for \<dots> vmpage_size option apply (case_tac "vmpage_size=ARMSmallPage") apply (frule_tac cap'=cap_b in cap_get_tag_isCap_unfolded_H_cap(16),
             assumption, simp add: cap_tag_defs) apply (frule_tac cap'=cap_b in cap_get_tag_isCap_unfolded_H_cap(17),
             assumption, simp add: cap_tag_defs) done

  \<comment> \<open>capa is PageCap\<close> subgoal for \<dots> vmpage_size option apply (cases "vmpage_size=ARMSmallPage")
    \<comment> \<open>capa is a small frame\<close> apply (frule cap_get_tag_isCap_unfolded_H_cap(16)[where cap' = cap_a], assumption) apply (cases capb;
            simp add: cap_get_tag_isCap_unfolded_H_cap isCap_simps cap_tag_defs from_bool_def)
   \<comment> \<open>capb is PageCap\<close> subgoal for \<dots> vmpage_sizea optiona apply (cases "vmpage_sizea=ARMSmallPage")
      \<comment> \<open>capb is a small frame\<close> apply (frule cap_get_tag_isCap_unfolded_H_cap(16)[where cap'=cap_b],
             assumption, simp add: cap_tag_defs) apply (intro conjI) apply (simp add:Kernel_C.ARMSmallPage_def) apply (simp add: gen_framesize_to_H_def) apply (simp add:Kernel_C.ARMSmallPage_def) apply (simp add: gen_framesize_to_H_def) apply (simp add: Let_def) apply (simp add: cap_get_tag_PageCap_small_frame [unfolded cap_tag_defs, simplified]) apply (thin_tac "ccap_relation x cap_b" for x) apply (frule_tac cap'=cap_a in cap_get_tag_isCap_unfolded_H_cap(16)[simplified], simp) apply (simp add: cap_get_tag_PageCap_small_frame) apply (thin_tac "ccap_relation x cap_a" for x) apply clarsimp apply (simp add: if_0_1_eq) apply (simp add: Kernel_C.ARMSmallPage_def gen_framesize_to_H_def) apply (simp add: field_simps)

     \<comment> \<open>capb is a frame\<close> apply (frule_tac cap'=cap_b in cap_get_tag_isCap_unfolded_H_cap(17),
            assumption, simp add: cap_tag_defs) apply (intro conjI) apply (simp add:Kernel_C.ARMSmallPage_def) apply (simp add: gen_framesize_to_H_def) subgoal by (simp add:cap_frame_cap_lift_def cap_lift_def cap_tag_defs mask_def word_bw_assocs) apply (simp add: pageBitsForSize_def) apply (cases "gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))"; simp) apply (subgoal_tac "capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> scast Kernel_C.ARMSmallPage") prefer 2 apply (drule ccap_relation_c_valid_cap[where c'= cap_b]) apply (simp add: cap_frame_cap_lift [unfolded cap_tag_defs, simplified]) apply (simp add: c_valid_cap_def cl_valid_cap_def) apply (simp add: Let_def) apply (simp add: cap_get_tag_PageCap_frame [unfolded cap_tag_defs, simplified]) apply (thin_tac "ccap_relation x cap_b" for x) apply (frule cap_get_tag_isCap_unfolded_H_cap(16)[simplified, where cap'=cap_a], simp) apply (simp add: cap_get_tag_PageCap_small_frame) apply (thin_tac "ccap_relation x cap_a" for x) apply clarsimp apply (simp add: if_0_1_eq) apply (cut_tac x="(pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))"
              in unat_of_nat32) apply (simp add: pageBitsForSize_def) apply (case_tac "gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))", simp_all add: word_bits_def)[1] apply clarsimp apply (simp add: gen_framesize_to_H_is_framesize_to_H_if_not_ARMSmallPage) apply (simp add: Kernel_C.ARMSmallPage_def gen_framesize_to_H_def) by (simp add: field_simps)

    \<comment> \<open>capa is a frame\<close> apply (frule cap_get_tag_isCap_unfolded_H_cap(17)[where cap' = cap_a], assumption) apply (subgoal_tac "capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a)") prefer 2 subgoal by (simp add:cap_frame_cap_lift_def cap_lift_def cap_tag_defs mask_def word_bw_assocs) apply (frule_tac cap'=cap_a in cap_get_tag_isCap_unfolded_H_cap(17)[simplified], simp) apply (subgoal_tac "capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> scast Kernel_C.ARMSmallPage") prefer 2 apply (drule_tac c'=cap_a in ccap_relation_c_valid_cap) apply (simp add: cap_frame_cap_lift) apply (simp add: c_valid_cap_def cl_valid_cap_def) apply (cases capb;
           simp add: cap_get_tag_isCap_unfolded_H_cap isCap_simps cap_tag_defs from_bool_def)
    \<comment> \<open>capb is PageCap\<close> subgoal for \<dots> vmpage_sizea optiona apply (cases "vmpage_sizea=ARMSmallPage")
     \<comment> \<open>capb is a small frame\<close> apply (frule cap_get_tag_isCap_unfolded_H_cap(16)[where cap'=cap_b],
            assumption, simp add: cap_tag_defs) apply (simp add: Let_def) apply (intro conjI) apply (simp add: pageBitsForSize_def) apply (cases "gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))"; simp) apply (simp add: mask_def Kernel_C.ARMSmallPage_def) apply (simp add: Kernel_C.ARMSmallPage_def gen_framesize_to_H_def) apply (frule cap_get_tag_isCap_unfolded_H_cap(17)[simplified, where cap'=cap_a], simp) apply (simp add: cap_tag_defs) apply (simp add: cap_get_tag_PageCap_small_frame [unfolded cap_tag_defs, simplified]) apply (simp add: cap_get_tag_PageCap_frame [unfolded cap_tag_defs, simplified]) apply (clarsimp simp: if_distrib [where f=scast]) apply (thin_tac "ccap_relation x y" for x y)+ apply (simp add: if_0_1_eq) apply (cut_tac x="(pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))"
              in unat_of_nat32) apply (simp add: pageBitsForSize_def) apply (cases "gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))"; simp add: word_bits_def) apply clarsimp apply (simp add: gen_framesize_to_H_is_framesize_to_H_if_not_ARMSmallPage) apply (simp add: Kernel_C.ARMSmallPage_def gen_framesize_to_H_def) apply (simp add: field_simps)

    \<comment> \<open>capb is a frame\<close> apply (frule cap_get_tag_isCap_unfolded_H_cap(17)[where cap'=cap_b],
           assumption, simp add: cap_tag_defs) apply (subgoal_tac "capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> scast Kernel_C.ARMSmallPage") prefer 2 apply (drule ccap_relation_c_valid_cap [unfolded cap_tag_defs, where c'=cap_b]) apply (simp add: cap_frame_cap_lift [unfolded cap_tag_defs, simplified]) apply (simp add: c_valid_cap_def cl_valid_cap_def) apply (frule cap_get_tag_isCap_unfolded_H_cap(17)[simplified, where cap'=cap_a], simp) apply (simp add: cap_tag_defs) apply (drule (1) iffD1 [OF cap_get_tag_PageCap_frame [unfolded cap_tag_defs, simplified]])+ apply clarify apply (intro conjI) apply (simp add: pageBitsForSize_def) apply (cases "gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))"; simp) subgoal by (simp add: cap_frame_cap_lift_def cap_lift_def cap_tag_defs mask_def word_bw_assocs) apply (simp add: pageBitsForSize_def) apply (case_tac "gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))"; simp) apply (simp add: Let_def) apply (simp add: if_0_1_eq if_distrib [where f=scast]) apply (cut_tac x="(pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))"
             in unat_of_nat32) apply (simp add: pageBitsForSize_def) apply (cases "gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))"; simp add: word_bits_def) apply clarsimp apply (cut_tac x="(pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))"
             in unat_of_nat32) apply (simp add: pageBitsForSize_def) apply (cases "gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))"; simp add: word_bits_def) apply clarsimp apply (simp add: gen_framesize_to_H_is_framesize_to_H_if_not_ARMSmallPage) by (simp add: field_simps) done

  \<comment> \<open>capa is PageTableCap\<close> apply (cases capb;
          simp_all add: cap_get_tag_isCap_unfolded_H_cap isCap_simps cap_tag_defs)
    \<comment> \<open>capb is PageCap\<close> subgoal for \<dots> vmpage_size option apply (cases "vmpage_size=ARMSmallPage") apply (frule cap_get_tag_isCap_unfolded_H_cap(16)[where cap'=cap_b],
                      assumption, simp add: cap_tag_defs) by (frule cap_get_tag_isCap_unfolded_H_cap(17)[where cap'=cap_b],
            assumption, simp add: cap_tag_defs)
   \<comment> \<open>capb is a PageTableCap\<close> subgoal apply (frule_tac cap'=cap_a in cap_get_tag_isCap_unfolded_H_cap(14)) apply (frule_tac cap'=cap_b in cap_get_tag_isCap_unfolded_H_cap(14)) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (simp add: ccap_relation_def  map_option_case) apply (simp add: cap_page_table_cap_lift) apply (simp add: cap_to_H_def) by (cases "capPTBasePtr_CL (cap_page_table_cap_lift cap_a) =
                    capPTBasePtr_CL (cap_page_table_cap_lift cap_b)"; simp)

  \<comment> \<open>capa is PageDirectoryCap\<close> apply (cases capb;
         simp add: cap_get_tag_isCap_unfolded_H_cap isCap_simps cap_tag_defs)
   \<comment> \<open>capb is PageCap\<close> subgoal for \<dots> vmpage_size option apply (cases "vmpage_size=ARMSmallPage") apply (frule cap_get_tag_isCap_unfolded_H_cap(16)[where cap'=cap_b],
            assumption, simp add: cap_tag_defs) by (frule cap_get_tag_isCap_unfolded_H_cap(17)[where cap'=cap_b],
           assumption, simp add: cap_tag_defs)
  \<comment> \<open>capb is a PageDirectoryCap\<close> subgoal apply (frule_tac cap'=cap_a in cap_get_tag_isCap_unfolded_H_cap(15)) apply (frule_tac cap'=cap_b in cap_get_tag_isCap_unfolded_H_cap(15)) apply (frule cap_get_tag_isCap_unfolded_H_cap) apply (simp add: ccap_relation_def  map_option_case) apply (simp add: cap_page_directory_cap_lift) apply (simp add: cap_to_H_def) by (cases "capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) =
                   capPDBasePtr_CL (cap_page_directory_cap_lift cap_b)"; simp) done done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<forall>capa capb. \<Gamma>\<turnstile> \<lbrace>ccap_relation (capability.ArchObjectCap capa) \<acute>cap_a \<and> ccap_relation (capability.ArchObjectCap capb) \<acute>cap_b\<rbrace> Call Arch_sameRegionAs_'proc \<lbrace>\<acute>ret__unsigned_long = from_bool (Arch.sameRegionAs capa capb)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<forall>capa capb. \<Gamma>\<turnstile> \<lbrace>ccap_relation (capability.ArchObjectCap capa) \<acute>cap_a \<and> ccap_relation (capability.ArchObjectCap capb) \<acute>cap_b\<rbrace> Call Arch_sameRegionAs_'proc \<lbrace>\<acute>ret__unsigned_long = from_bool (Arch.sameRegionAs capa capb)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation (capability.ArchObjectCap capa) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b\<rbrakk> \<Longrightarrow> \<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_a \<in> insert (SCAST(32 signed \<rightarrow> 32) cap_frame_cap) (Collect ((=) (SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap))) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> ((if cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) \<noteq> 0 \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> (cap_small_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_a) \<longrightarrow> cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_small_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))))) \<and> (cap_small_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> (cap_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capFSize_CL (cap_frame_cap_lift cap_b) \<longrightarrow> UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b)) && mask 2 = UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b)) \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))))))) \<and> (cap_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 && mask 2 = SCAST(32 signed \<rightarrow> 32) 0 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) \<le> SCAST(32 signed \<rightarrow> 32) 0 \<and> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<and> SCAST(32 signed \<rightarrow> 32) 0 \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)))))))))) \<and> (cap_small_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_a) \<longrightarrow> (cap_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_a) \<longrightarrow> cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_small_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capFSize_CL (cap_frame_cap_lift cap_a) \<longrightarrow> UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a)) && mask 2 = UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a)) \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))))))) \<and> (cap_small_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> (cap_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capFSize_CL (cap_frame_cap_lift cap_a) \<longrightarrow> UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a)) && mask 2 = UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a)) \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capFSize_CL (cap_frame_cap_lift cap_b) \<longrightarrow> UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b)) && mask 2 = UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b)) \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)))))))))) \<and> (cap_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 && mask 2 = SCAST(32 signed \<rightarrow> 32) 0 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) \<le> SCAST(32 signed \<rightarrow> 32) 0 \<and> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<and> SCAST(32 signed \<rightarrow> 32) 0 \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capFSize_CL (cap_frame_cap_lift cap_a) \<longrightarrow> UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a)) && mask 2 = UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a)) \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 && mask 2 = SCAST(32 signed \<rightarrow> 32) 0 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) \<le> SCAST(32 signed \<rightarrow> 32) 0 \<and> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))))) - 1) \<and> SCAST(32 signed \<rightarrow> 32) 0 \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)))))))))))) \<and> (cap_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_small_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 && mask 2 = SCAST(32 signed \<rightarrow> 32) 0 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if SCAST(32 signed \<rightarrow> 32) 0 \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))))) \<and> (cap_small_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> (cap_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 && mask 2 = SCAST(32 signed \<rightarrow> 32) 0 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if SCAST(32 signed \<rightarrow> 32) 0 \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capFSize_CL (cap_frame_cap_lift cap_b) \<longrightarrow> UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b)) && mask 2 = UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b)) \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if SCAST(32 signed \<rightarrow> 32) 0 \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))))) - 1) \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))))))) \<and> (cap_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 && mask 2 = SCAST(32 signed \<rightarrow> 32) 0 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 && mask 2 = SCAST(32 signed \<rightarrow> 32) 0 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if SCAST(32 signed \<rightarrow> 32) 0 \<le> SCAST(32 signed \<rightarrow> 32) 0 \<and> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<and> SCAST(32 signed \<rightarrow> 32) 0 \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)))))))))))) \<and> ((if cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap then 1 else 0) = 0 \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> ((if cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) \<noteq> 0 \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> (cap_small_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_a) \<longrightarrow> cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_small_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))))) \<and> (cap_small_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> (cap_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capFSize_CL (cap_frame_cap_lift cap_b) \<longrightarrow> UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b)) && mask 2 = UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b)) \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))))))) \<and> (cap_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 && mask 2 = SCAST(32 signed \<rightarrow> 32) 0 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) \<le> SCAST(32 signed \<rightarrow> 32) 0 \<and> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<and> SCAST(32 signed \<rightarrow> 32) 0 \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)))))))))) \<and> (cap_small_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_a) \<longrightarrow> (cap_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_a) \<longrightarrow> cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_small_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capFSize_CL (cap_frame_cap_lift cap_a) \<longrightarrow> UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a)) && mask 2 = UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a)) \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))))))) \<and> (cap_small_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> (cap_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capFSize_CL (cap_frame_cap_lift cap_a) \<longrightarrow> UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a)) && mask 2 = UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a)) \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capFSize_CL (cap_frame_cap_lift cap_b) \<longrightarrow> UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b)) && mask 2 = UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b)) \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)))))))))) \<and> (cap_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 && mask 2 = SCAST(32 signed \<rightarrow> 32) 0 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) \<le> SCAST(32 signed \<rightarrow> 32) 0 \<and> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<and> SCAST(32 signed \<rightarrow> 32) 0 \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capFSize_CL (cap_frame_cap_lift cap_a) \<longrightarrow> UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a)) && mask 2 = UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a)) \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 && mask 2 = SCAST(32 signed \<rightarrow> 32) 0 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) \<le> SCAST(32 signed \<rightarrow> 32) 0 \<and> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_a))))))) - 1) \<and> SCAST(32 signed \<rightarrow> 32) 0 \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)))))))))))) \<and> (cap_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_small_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 && mask 2 = SCAST(32 signed \<rightarrow> 32) 0 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if SCAST(32 signed \<rightarrow> 32) 0 \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))))) \<and> (cap_small_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> (cap_frame_cap = UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 && mask 2 = SCAST(32 signed \<rightarrow> 32) 0 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if SCAST(32 signed \<rightarrow> 32) 0 \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ret__unsigned. ret__unsigned = capFSize_CL (cap_frame_cap_lift cap_b) \<longrightarrow> UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b)) && mask 2 = UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b)) \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if SCAST(32 signed \<rightarrow> 32) 0 \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))))) - 1) \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<and> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) \<le> UCAST(32 \<rightarrow> 32) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (UCAST(32 \<rightarrow> 32) (capFSize_CL (cap_frame_cap_lift cap_b))))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))))))))) \<and> (cap_frame_cap \<noteq> UCAST(32 \<rightarrow> 32 signed) (cap_get_tag cap_b) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 && mask 2 = SCAST(32 signed \<rightarrow> 32) 0 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> SCAST(32 signed \<rightarrow> 32) 0 && mask 2 = SCAST(32 signed \<rightarrow> 32) 0 \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))) < SCAST(32 signed \<rightarrow> 32) 0x20 \<and> SCAST(32 signed \<rightarrow> 32) (if SCAST(32 signed \<rightarrow> 32) 0 \<le> SCAST(32 signed \<rightarrow> 32) 0 \<and> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) \<and> SCAST(32 signed \<rightarrow> 32) 0 \<le> SCAST(32 signed \<rightarrow> 32) 0 + ((1 << unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) 0))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)))))))))))) \<and> ((if cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap then 1 else 0) = 0 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (Arch.sameRegionAs capa capb)))))) \<and> (cap_get_tag cap_a \<notin> insert (SCAST(32 signed \<rightarrow> 32) cap_frame_cap) (Collect ((=) (SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap))) \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capPTBasePtr_CL (cap_page_table_cap_lift cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)))) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (Arch.sameRegionAs capa capb)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)))) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (Arch.sameRegionAs capa capb)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) true = from_bool (Arch.sameRegionAs capa capb)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (Arch.sameRegionAs capa capb)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = cap_get_tag cap_b \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capASIDPool_CL (cap_asid_pool_cap_lift cap_a) \<longrightarrow> (\<forall>ret__unsigned. ret__unsigned = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) \<longrightarrow> SCAST(32 signed \<rightarrow> 32) (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)))) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (Arch.sameRegionAs capa capb)))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> SCAST(32 signed \<rightarrow> 32) false = from_bool (Arch.sameRegionAs capa capb)))))) proof (prove)
goal (1 subgoal):
 1. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation (capability.ArchObjectCap capa) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> Arch.sameRegionAs capa capb))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> Arch.sameRegionAs capa capb))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> Arch.sameRegionAs capa capb)) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> Arch.sameRegionAs capa capb)) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> Arch.sameRegionAs capa capb) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> Arch.sameRegionAs capa capb)) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (Arch.sameRegionAs capa capb)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> Arch.sameRegionAs capa capb)) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> Arch.sameRegionAs capa capb))))) proof (prove)
goal (1 subgoal):
 1. \<And>capa capb cap_b cap_a. \<lbrakk>ccap_relation (capability.ArchObjectCap capa) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap capa) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if isPageCap capa \<and> isPageCap capb then let botA = capVPBasePtr capa; botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in botA \<le> botB \<and> topB \<le> botA + 2 ^ pageBitsForSize (capVPSize capa) - 1 \<and> botB \<le> topB else if isPageTableCap capa \<and> isPageTableCap capb then capPTBasePtr capa = capPTBasePtr capb else if isPageDirectoryCap capa \<and> isPageDirectoryCap capb then capPDBasePtr capa = capPDBasePtr capb else if isASIDControlCap capa \<and> isASIDControlCap capb then True else if isASIDPoolCap capa \<and> isASIDPoolCap capb then capASIDPool capa = capASIDPool capb else False)))))) proof (prove)
goal (5 subgoals):
 1. \<And>x11 x12. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.ASIDPoolCap x11 x12\<rbrakk> \<Longrightarrow> (cap_asid_pool_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False)))) \<and> (cap_asid_pool_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False)))) \<and> (cap_asid_pool_cap \<noteq> cap_frame_cap \<and> cap_asid_pool_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_asid_pool_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False))) \<and> (cap_page_table_cap \<noteq> cap_asid_pool_cap \<longrightarrow> (cap_page_directory_cap = cap_asid_pool_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False))) \<and> (cap_page_directory_cap \<noteq> cap_asid_pool_cap \<longrightarrow> (cap_asid_control_cap = cap_asid_pool_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False))) \<and> (cap_asid_control_cap \<noteq> cap_asid_pool_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.ASIDPoolCap v0 v1 then x11 = capASIDPool capb else False))))))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> (cap_asid_control_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap \<noteq> cap_frame_cap \<and> cap_asid_control_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_table_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_page_directory_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_directory_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb = arch_capability.ASIDControlCap) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))))
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))))))
 4. \<And>x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (cap_page_table_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap \<noteq> cap_frame_cap \<and> cap_page_table_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))
 5. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (6 subgoals):
 1. \<And>x11 x12 x11a x12a. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11a x12a)) cap_b; capa = arch_capability.ASIDPoolCap x11 x12; capb = arch_capability.ASIDPoolCap x11a x12a\<rbrakk> \<Longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (x11 = x11a)
 2. \<And>x11 x12 x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_b; capa = arch_capability.ASIDPoolCap x11 x12; capb = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 5 \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> (cap_asid_control_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap \<noteq> cap_frame_cap \<and> cap_asid_control_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_table_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_page_directory_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_directory_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb = arch_capability.ASIDControlCap) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))))
 4. \<And>x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))))))
 5. \<And>x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (cap_page_table_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap \<noteq> cap_frame_cap \<and> cap_page_table_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))
 6. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (6 subgoals):
 1. \<And>x11 x12 x11a x12a. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11a x12a)) cap_b; capa = arch_capability.ASIDPoolCap x11 x12; capb = arch_capability.ASIDPoolCap x11a x12a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (x11 = x11a)
 2. \<And>x11 x12 x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_b; capa = arch_capability.ASIDPoolCap x11 x12; capb = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 5 \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> (cap_asid_control_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap \<noteq> cap_frame_cap \<and> cap_asid_control_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_table_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_page_directory_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_directory_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb = arch_capability.ASIDControlCap) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))))
 4. \<And>x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))))))
 5. \<And>x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (cap_page_table_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap \<noteq> cap_frame_cap \<and> cap_page_table_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))
 6. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (6 subgoals):
 1. \<And>x11 x12 x11a x12a. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11a x12a)) cap_b; capa = arch_capability.ASIDPoolCap x11 x12; capb = arch_capability.ASIDPoolCap x11a x12a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (x11 = x11a)
 2. \<And>x11 x12 x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_b; capa = arch_capability.ASIDPoolCap x11 x12; capb = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 5 \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> (cap_asid_control_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap \<noteq> cap_frame_cap \<and> cap_asid_control_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_table_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_page_directory_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_directory_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb = arch_capability.ASIDControlCap) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))))
 4. \<And>x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))))))
 5. \<And>x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (cap_page_table_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap \<noteq> cap_frame_cap \<and> cap_page_table_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))
 6. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (6 subgoals):
 1. \<And>x11 x12 x11a x12a. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11a x12a)) cap_b; capa = arch_capability.ASIDPoolCap x11 x12; capb = arch_capability.ASIDPoolCap x11a x12a; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (x11 = x11a)
 2. \<And>x11 x12 x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_b; capa = arch_capability.ASIDPoolCap x11 x12; capb = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 5 \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> (cap_asid_control_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap \<noteq> cap_frame_cap \<and> cap_asid_control_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_table_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_page_directory_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_directory_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb = arch_capability.ASIDControlCap) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))))
 4. \<And>x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))))))
 5. \<And>x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (cap_page_table_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap \<noteq> cap_frame_cap \<and> cap_page_table_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))
 6. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (6 subgoals):
 1. \<And>x11 x12 x11a x12a. \<lbrakk>Some (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) = (case cap_lift cap_a of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); Some (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11a x12a)) = (case cap_lift cap_b of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); capa = arch_capability.ASIDPoolCap x11 x12; capb = arch_capability.ASIDPoolCap x11a x12a; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap\<rbrakk> \<Longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (x11 = x11a)
 2. \<And>x11 x12 x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_b; capa = arch_capability.ASIDPoolCap x11 x12; capb = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 5 \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> (cap_asid_control_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap \<noteq> cap_frame_cap \<and> cap_asid_control_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_table_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_page_directory_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_directory_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb = arch_capability.ASIDControlCap) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))))
 4. \<And>x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))))))
 5. \<And>x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (cap_page_table_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap \<noteq> cap_frame_cap \<and> cap_page_table_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))
 6. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (6 subgoals):
 1. \<And>x11 x12 x11a x12a. \<lbrakk>capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12) = cap_to_H (Cap_asid_pool_cap (cap_asid_pool_cap_lift cap_a)); capability.ArchObjectCap (arch_capability.ASIDPoolCap x11a x12a) = cap_to_H (Cap_asid_pool_cap (cap_asid_pool_cap_lift cap_b)); capa = arch_capability.ASIDPoolCap x11 x12; capb = arch_capability.ASIDPoolCap x11a x12a; cap_lift cap_b = Some (Cap_asid_pool_cap (cap_asid_pool_cap_lift cap_b)); cap_lift cap_a = Some (Cap_asid_pool_cap (cap_asid_pool_cap_lift cap_a))\<rbrakk> \<Longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (x11 = x11a)
 2. \<And>x11 x12 x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_b; capa = arch_capability.ASIDPoolCap x11 x12; capb = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 5 \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> (cap_asid_control_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap \<noteq> cap_frame_cap \<and> cap_asid_control_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_table_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_page_directory_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_directory_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb = arch_capability.ASIDControlCap) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))))
 4. \<And>x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))))))
 5. \<And>x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (cap_page_table_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap \<noteq> cap_frame_cap \<and> cap_page_table_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))
 6. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (6 subgoals):
 1. \<And>x11 x11a. \<lbrakk>x11 = capASIDPool_CL (cap_asid_pool_cap_lift cap_a); x11a = capASIDPool_CL (cap_asid_pool_cap_lift cap_b); capa = arch_capability.ASIDPoolCap (capASIDPool_CL (cap_asid_pool_cap_lift cap_a)) (capASIDBase_CL (cap_asid_pool_cap_lift cap_a)); capb = arch_capability.ASIDPoolCap (capASIDPool_CL (cap_asid_pool_cap_lift cap_b)) (capASIDBase_CL (cap_asid_pool_cap_lift cap_b)); cap_lift cap_b = Some (Cap_asid_pool_cap (cap_asid_pool_cap_lift cap_b)); cap_lift cap_a = Some (Cap_asid_pool_cap (cap_asid_pool_cap_lift cap_a))\<rbrakk> \<Longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b))
 2. \<And>x11 x12 x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_b; capa = arch_capability.ASIDPoolCap x11 x12; capb = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 5 \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> (cap_asid_control_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap \<noteq> cap_frame_cap \<and> cap_asid_control_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_table_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_page_directory_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_directory_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb = arch_capability.ASIDControlCap) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))))
 4. \<And>x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))))))
 5. \<And>x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (cap_page_table_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap \<noteq> cap_frame_cap \<and> cap_page_table_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))
 6. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (5 subgoals):
 1. \<And>x11 x12 x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_b; capa = arch_capability.ASIDPoolCap x11 x12; capb = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 5 \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> (cap_asid_control_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap \<noteq> cap_frame_cap \<and> cap_asid_control_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_table_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_page_directory_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_directory_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb = arch_capability.ASIDControlCap) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))))
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))))))
 4. \<And>x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (cap_page_table_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap \<noteq> cap_frame_cap \<and> cap_page_table_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))
 5. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11_ x12_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.ASIDPoolCap x11_ x12_; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 5 \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11_ x12_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.ASIDPoolCap x11_ x12_; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; cap_get_tag cap_b = 5\<rbrakk> \<Longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11_ x12_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.ASIDPoolCap x11_ x12_; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; cap_get_tag cap_b = 5; vmpage_size = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11_ x12_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.ASIDPoolCap x11_ x12_; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; cap_get_tag cap_b = 5; vmpage_size \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11_ x12_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.ASIDPoolCap x11_ x12_; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; cap_get_tag cap_b = 5; vmpage_size \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false proof (prove)
goal:
No subgoals! proof (prove)
goal (4 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> (cap_asid_control_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))) \<and> (cap_asid_control_cap \<noteq> cap_frame_cap \<and> cap_asid_control_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_table_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_page_directory_cap = cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (capb = arch_capability.ASIDControlCap)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap)) \<and> (cap_page_directory_cap \<noteq> cap_asid_control_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb = arch_capability.ASIDControlCap) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<longrightarrow> capb \<noteq> arch_capability.ASIDControlCap))))
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))))))
 3. \<And>x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (cap_page_table_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap \<noteq> cap_frame_cap \<and> cap_page_table_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))
 4. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_b; capa = arch_capability.ASIDControlCap; capb = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> cap_get_tag cap_b \<noteq> 0xB
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))))))
 3. \<And>x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (cap_page_table_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap \<noteq> cap_frame_cap \<and> cap_page_table_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))
 4. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.ASIDControlCap; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option\<rbrakk> \<Longrightarrow> cap_get_tag cap_b \<noteq> 0xB proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.ASIDControlCap; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap_b \<noteq> 0xB
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.ASIDControlCap; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap_b \<noteq> 0xB proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap arch_capability.ASIDControlCap) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.ASIDControlCap; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap_b \<noteq> 0xB proof (prove)
goal:
No subgoals! proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32 \<le> botB \<and> topB \<le> x32 + 2 ^ pageBitsForSize x34 - 1 \<and> botB \<le> topB else False))))))
 2. \<And>x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (cap_page_table_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap \<noteq> cap_frame_cap \<and> cap_page_table_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))
 3. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))))))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size = Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))))))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))))) proof (prove)
goal (2 subgoals):
 1. \<And>x31a x32a x33a x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a x32a x33a x34 x35)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a x32a x33a x34 x35\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a + 2 ^ pageBitsForSize x34 - 1 in x32_ \<le> x32a \<and> topB \<le> 0xFFF + x32_ \<and> x32a \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a + 2 ^ pageBitsForSize x34 - 1 in x32_ \<le> x32a \<and> topB \<le> 0xFFF + x32_ \<and> x32a \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a + 2 ^ pageBitsForSize x34 - 1 in x32_ \<le> x32a \<and> topB \<le> 0xFFF + x32_ \<and> x32a \<le> topB)))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB)))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = 0xFFF + x32a_ in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 4. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20
 5. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = 0xFFF + x32a_ in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 6. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20
 4. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = 0xFFF + x32a_ in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 5. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = 0xFFF + x32a_ in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 4. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = 0xFFF + x32a_ in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = 0xFFF + x32a_ in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case x32_ \<le> x32a_ \<and> 0xFFF + x32a_ \<le> 0xFFF + x32_ \<and> x32a_ \<le> 0xFFF + x32a_ of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))))) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)) \<and> x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)) \<and> optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case x32_ \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + x32_ \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)) \<and> x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)) \<and> optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case x32_ \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + x32_ \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)) \<and> x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)) \<and> optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case x32_ \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + x32_ \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))))) cap_a; capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)) \<and> x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)) \<and> optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)) \<and> x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)) \<and> option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)) \<and> x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)) \<and> optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)) \<and> x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)) \<and> option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)); x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b); x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)); optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)); option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)); x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b); x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)); optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)); option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1)) = (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)); x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b); x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)); optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)); option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + 0xFFF \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + 0xFFF \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + 0xFFF) = (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b)
 4. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20
 5. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b)
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20
 4. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> word_of_nat (case gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) of local.ARMSmallPage \<Rightarrow> 12 | local.ARMLargePage \<Rightarrow> 16 | local.ARMSection \<Rightarrow> 20 | local.ARMSuperSection \<Rightarrow> 24) < 0x20
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; c_valid_cap cap_b\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_lift cap_b = Some (Cap_frame_cap (cap_frame_cap_lift cap_b)); c_valid_cap cap_b\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> 0xFFF + x32_ \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case x32_ \<le> x32a_ \<and> x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 \<le> 0xFFF + x32_ \<and> x32a_ \<le> x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))))) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)) \<and> x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)) \<and> vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<and> optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case x32_ \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> 0xFFF + x32_ \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)) \<and> x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)) \<and> vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<and> optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case x32_ \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> 0xFFF + x32_ \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option)) cap_a; capa = arch_capability.PageCap x31_ x32_ x33_ Wellformed_C.ARMSmallPage option; vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)) \<and> x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)) \<and> vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<and> optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case x32_ \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> 0xFFF + x32_ \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))))) cap_a; capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)) \<and> x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)) \<and> vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<and> optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)) \<and> x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)) \<and> option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)) \<and> x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)) \<and> vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<and> optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)) \<and> x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)) \<and> option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)); option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)); option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1)) = (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)); option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) < 2 ^ word_bits
 2. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)); option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1)) = (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)); option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (case gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) of local.ARMSmallPage \<Rightarrow> 12 | local.ARMLargePage \<Rightarrow> 16 | local.ARMSection \<Rightarrow> 20 | local.ARMSuperSection \<Rightarrow> 24) < 2 ^ word_bits
 2. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)); option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1)) = (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)); option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1)) = (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)); option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1)) = (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)); option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); unat (word_of_nat (pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) = pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1)) = (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_size = Wellformed_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> 0; x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x31_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_a)); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x32_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); x33_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_a)); option = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_a) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_a), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_a))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); unat (word_of_nat (pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) = pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + 0xFFF \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1)) = (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a)\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))))))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a)\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a)\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))))))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; c_valid_cap cap_a\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); cap_lift cap_a = Some (Cap_frame_cap (cap_frame_cap_lift cap_a)); c_valid_cap cap_a\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))) \<and> (cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> cap_get_tag cap_a \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_control_cap \<noteq> cap_get_tag cap_a \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap = cap_get_tag cap_a \<longrightarrow> (cap_get_tag cap_b = cap_get_tag cap_a \<longrightarrow> (if capASIDPool_CL (cap_asid_pool_cap_lift cap_a) = capASIDPool_CL (cap_asid_pool_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)) \<and> (cap_get_tag cap_b \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False))) \<and> (SCAST(32 signed \<rightarrow> 32) cap_asid_pool_cap \<noteq> cap_get_tag cap_a \<longrightarrow> \<not> (if \<exists>d v0 v1 v2 v3. capb = arch_capability.PageCap d v0 v1 v2 v3 then let botB = capVPBasePtr capb; topB = botB + 2 ^ pageBitsForSize (capVPSize capb) - 1 in x32_ \<le> botB \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> botB \<le> topB else False)))))) proof (prove)
goal (1 subgoal):
 1. \<And>x31a x32a x33a x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a x32a x33a x34 x35)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a x32a x33a x34 x35\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a + 2 ^ pageBitsForSize x34 - 1 in x32_ \<le> x32a \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a + 2 ^ pageBitsForSize x34 - 1 in x32_ \<le> x32a \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a + 2 ^ pageBitsForSize x34 - 1 in x32_ \<le> x32a \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a \<le> topB))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB)))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = 0xFFF + x32a_ in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case x32_ \<le> x32a_ \<and> 0xFFF + x32a_ \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> 0xFFF + x32a_ of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20
 4. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case x32_ \<le> x32a_ \<and> 0xFFF + x32a_ \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> 0xFFF + x32a_ of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 5. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> word_of_nat (case gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) of local.ARMSmallPage \<Rightarrow> 12 | local.ARMLargePage \<Rightarrow> 16 | local.ARMSection \<Rightarrow> 20 | local.ARMSuperSection \<Rightarrow> 24) < 0x20
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20
 4. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case x32_ \<le> x32a_ \<and> 0xFFF + x32a_ \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> 0xFFF + x32a_ of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 5. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case x32_ \<le> x32a_ \<and> 0xFFF + x32a_ \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> 0xFFF + x32a_ of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 4. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case x32_ \<le> x32a_ \<and> 0xFFF + x32a_ \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> 0xFFF + x32a_ of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case x32_ \<le> x32a_ \<and> 0xFFF + x32a_ \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> 0xFFF + x32a_ of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case x32_ \<le> x32a_ \<and> 0xFFF + x32a_ \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> 0xFFF + x32a_ of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ Wellformed_C.ARMSmallPage optiona; vmpage_sizea = Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 1; cap_get_tag cap_a = 3\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case x32_ \<le> x32a_ \<and> 0xFFF + x32a_ \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> 0xFFF + x32a_ of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))))) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)) \<and> x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)) \<and> optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); cap_get_tag cap_a = 3\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case x32_ \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))))) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))))) cap_b; capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)) \<and> x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)) \<and> optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)) \<and> x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<and> x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)) \<and> vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<and> option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))))) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))))) cap_b; capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)); x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)); optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)); x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)); optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)); x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)); optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)); x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)); optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) < 2 ^ word_bits
 2. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)); x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)); optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b))
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)); x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)); optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (case gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) of local.ARMSmallPage \<Rightarrow> 12 | local.ARMLargePage \<Rightarrow> 16 | local.ARMSection \<Rightarrow> 20 | local.ARMSuperSection \<Rightarrow> 24) < 2 ^ word_bits
 2. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)); x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)); optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b))
 3. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)); x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)); optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)); x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)); optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)); x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)); optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); unat (word_of_nat (pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> 0; capb = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b))) (cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b)) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b))) Wellformed_C.ARMSmallPage (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); vmpage_sizea = Wellformed_C.ARMSmallPage; x31a_ = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap_b)); x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x32a_ = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x33a_ = vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap_b)); optiona = (if cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b) = 0 then None else Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap_b) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap_b), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap_b))); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); unat (word_of_nat (pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + 0xFFF \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + 0xFFF) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> 0xFFF + cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b))
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (cap_get_tag cap_b = 1 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 1 \<longrightarrow> (cap_get_tag cap_b = 3 \<longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)) \<and> (cap_get_tag cap_b \<noteq> 3 \<longrightarrow> \<not> (let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0)
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; c_valid_cap cap_b\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_lift cap_b = Some (Cap_frame_cap (cap_frame_cap_lift cap_b)); c_valid_cap cap_b\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona)) cap_b; capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona; vmpage_sizea \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option) = capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a)))); capability.ArchObjectCap (arch_capability.PageCap x31a_ x32a_ x33a_ vmpage_sizea optiona) = capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))))\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = x32a_ + 2 ^ pageBitsForSize vmpage_sizea - 1 in x32_ \<le> x32a_ \<and> topB \<le> x32_ + 2 ^ pageBitsForSize vmpage_size - 1 \<and> x32a_ \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 in cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> topB \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20
 2. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b)
 3. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20
 4. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 in cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> topB \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> word_of_nat (case gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) of local.ARMSmallPage \<Rightarrow> 12 | local.ARMLargePage \<Rightarrow> 16 | local.ARMSection \<Rightarrow> 20 | local.ARMSuperSection \<Rightarrow> 24) < 0x20
 2. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b)
 3. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20
 4. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 in cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> topB \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b)
 2. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20
 3. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 in cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> topB \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20
 2. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 in cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> topB \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> word_of_nat (case gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) of local.ARMSmallPage \<Rightarrow> 12 | local.ARMLargePage \<Rightarrow> 16 | local.ARMSection \<Rightarrow> 20 | local.ARMSuperSection \<Rightarrow> 24) < 0x20
 2. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 in cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> topB \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) \<noteq> Wellformed_C.ARMSmallPage; capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) \<noteq> Wellformed_C.ARMSmallPage; cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case let topB = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 in cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> topB \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> topB of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = (case cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 of True \<Rightarrow> word_of_nat 1 | False \<Rightarrow> word_of_nat 0) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) < 2 ^ word_bits
 2. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))\<rbrakk> \<Longrightarrow> (case gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) of local.ARMSmallPage \<Rightarrow> 12 | local.ARMLargePage \<Rightarrow> 16 | local.ARMSection \<Rightarrow> 20 | local.ARMSuperSection \<Rightarrow> 24) < 2 ^ word_bits
 2. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))\<rbrakk> \<Longrightarrow> pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) < 2 ^ word_bits
 2. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); unat (word_of_nat (case gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) of local.ARMSmallPage \<Rightarrow> 12 | local.ARMLargePage \<Rightarrow> 16 | local.ARMSection \<Rightarrow> 20 | local.ARMSuperSection \<Rightarrow> 24)) = (case gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)) of local.ARMSmallPage \<Rightarrow> 12 | local.ARMLargePage \<Rightarrow> 16 | local.ARMSection \<Rightarrow> 20 | local.ARMSuperSection \<Rightarrow> 24)\<rbrakk> \<Longrightarrow> (case gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)) of local.ARMSmallPage \<Rightarrow> 12 | local.ARMLargePage \<Rightarrow> 16 | local.ARMSection \<Rightarrow> 20 | local.ARMSuperSection \<Rightarrow> 24) < 2 ^ word_bits
 2. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))); unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) = pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capa = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a); capFSize_CL (cap_frame_cap_lift cap_a) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; capb = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b))) (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b)) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b))) (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); cap_get_tag cap_b = 3; capFSize_CL (cap_frame_cap_lift cap_b) \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage; cap_get_tag cap_a = 3; x31_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_a)); x31a_ = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap_b)); x32_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a); x32a_ = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b); x33_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_a)); x33a_ = vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap_b)); option = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_a) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_a), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_a))); vmpage_size = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)); optiona = (if cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b) = 0 then None else Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap_b) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap_b), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap_b))); vmpage_sizea = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)); unat (word_of_nat (pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) = pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))); unat (word_of_nat (pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) = pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1)) = (cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1 \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))) - 1 \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + 2 ^ pageBitsForSize (framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))) - 1) proof (prove)
goal:
No subgoals! proof (prove)
goal (2 subgoals):
 1. \<And>x41 x42. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (cap_page_table_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))) \<and> (cap_page_table_cap \<noteq> cap_frame_cap \<and> cap_page_table_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageTableCap v0 v1 then x41 = capPTBasePtr capb else False)))
 2. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (3 subgoals):
 1. \<And>x41 x42 x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_b; capa = arch_capability.PageTableCap x41 x42; capb = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 7 \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<And>x41 x42 x41a x42a. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41a x42a)) cap_b; capa = arch_capability.PageTableCap x41 x42; capb = arch_capability.PageTableCap x41a x42a\<rbrakk> \<Longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (x41 = x41a)
 3. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41_ x42_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.PageTableCap x41_ x42_; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 7 \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41_ x42_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.PageTableCap x41_ x42_; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 7 \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41_ x42_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.PageTableCap x41_ x42_; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 7 \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41_ x42_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.PageTableCap x41_ x42_; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 7 \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false proof (prove)
goal (2 subgoals):
 1. \<And>x41 x42 x41a x42a. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41a x42a)) cap_b; capa = arch_capability.PageTableCap x41 x42; capb = arch_capability.PageTableCap x41a x42a\<rbrakk> \<Longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (x41 = x41a)
 2. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41_ x42_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41a_ x42a_)) cap_b; capa = arch_capability.PageTableCap x41_ x42_; capb = arch_capability.PageTableCap x41a_ x42a_\<rbrakk> \<Longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (x41_ = x41a_) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41_ x42_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41a_ x42a_)) cap_b; capa = arch_capability.PageTableCap x41_ x42_; capb = arch_capability.PageTableCap x41a_ x42a_; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (x41_ = x41a_) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41_ x42_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41a_ x42a_)) cap_b; capa = arch_capability.PageTableCap x41_ x42_; capb = arch_capability.PageTableCap x41a_ x42a_; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (x41_ = x41a_) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41_ x42_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageTableCap x41a_ x42a_)) cap_b; capa = arch_capability.PageTableCap x41_ x42_; capb = arch_capability.PageTableCap x41a_ x42a_; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (x41_ = x41a_) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (capability.ArchObjectCap (arch_capability.PageTableCap x41_ x42_)) = (case cap_lift cap_a of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); Some (capability.ArchObjectCap (arch_capability.PageTableCap x41a_ x42a_)) = (case cap_lift cap_b of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); capa = arch_capability.PageTableCap x41_ x42_; capb = arch_capability.PageTableCap x41a_ x42a_; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap\<rbrakk> \<Longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (x41_ = x41a_) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capability.ArchObjectCap (arch_capability.PageTableCap x41_ x42_) = cap_to_H (Cap_page_table_cap (cap_page_table_cap_lift cap_a)); capability.ArchObjectCap (arch_capability.PageTableCap x41a_ x42a_) = cap_to_H (Cap_page_table_cap (cap_page_table_cap_lift cap_b)); capa = arch_capability.PageTableCap x41_ x42_; capb = arch_capability.PageTableCap x41a_ x42a_; cap_lift cap_b = Some (Cap_page_table_cap (cap_page_table_cap_lift cap_b)); cap_lift cap_a = Some (Cap_page_table_cap (cap_page_table_cap_lift cap_a))\<rbrakk> \<Longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (x41_ = x41a_) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x41_ = capPTBasePtr_CL (cap_page_table_cap_lift cap_a) \<and> x42_ = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift cap_a)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift cap_a), capPTMappedAddress_CL (cap_page_table_cap_lift cap_a)) else None); x41a_ = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) \<and> x42a_ = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift cap_b)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift cap_b), capPTMappedAddress_CL (cap_page_table_cap_lift cap_b)) else None); capa = arch_capability.PageTableCap (capPTBasePtr_CL (cap_page_table_cap_lift cap_a)) (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift cap_a)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift cap_a), capPTMappedAddress_CL (cap_page_table_cap_lift cap_a)) else None); capb = arch_capability.PageTableCap (capPTBasePtr_CL (cap_page_table_cap_lift cap_b)) (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift cap_b)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift cap_b), capPTMappedAddress_CL (cap_page_table_cap_lift cap_b)) else None); cap_lift cap_b = Some (Cap_page_table_cap (cap_page_table_cap_lift cap_b)); cap_lift cap_a = Some (Cap_page_table_cap (cap_page_table_cap_lift cap_a))\<rbrakk> \<Longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b)) proof (prove)
goal (1 subgoal):
 1. \<And>x51 x52. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap capb) cap_b; capa = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> (cap_page_directory_cap = cap_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_frame_cap = cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_frame_cap \<noteq> cap_small_frame_cap \<longrightarrow> capFSize_CL (cap_frame_cap_lift cap_a) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_a) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a)))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_a))))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap = cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (cap_small_frame_cap = cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_small_frame_cap \<noteq> cap_frame_cap \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage && mask 2 = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage))) < 0x20 \<and> capFSize_CL (cap_frame_cap_lift cap_b) && mask 2 = capFSize_CL (cap_frame_cap_lift cap_b) \<and> word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b)))) < 0x20 \<and> (if cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) \<le> cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap_a) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage)))) - 1) \<and> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) \<le> cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap_b) + (2 ^ unat (word_of_nat (pageBitsForSize (gen_framesize_to_H (capFSize_CL (cap_frame_cap_lift cap_b))))) - 1) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) \<and> (cap_page_directory_cap \<noteq> cap_frame_cap \<and> cap_page_directory_cap \<noteq> cap_small_frame_cap \<longrightarrow> (cap_page_table_cap = cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPTBasePtr_CL (cap_page_table_cap_lift cap_a) = capPTBasePtr_CL (cap_page_table_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False))) \<and> (cap_page_table_cap \<noteq> cap_page_directory_cap \<longrightarrow> (cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)) \<and> (cap_get_tag cap_b \<noteq> SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap \<longrightarrow> \<not> (if \<exists>v0 v1. capb = arch_capability.PageDirectoryCap v0 v1 then x51 = capPDBasePtr capb else False)))) proof (prove)
goal (2 subgoals):
 1. \<And>x51 x52 x31 x32 x33 x34 x35. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) cap_b; capa = arch_capability.PageDirectoryCap x51 x52; capb = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 9 \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<And>x51 x52 x51a x52a. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51a x52a)) cap_b; capa = arch_capability.PageDirectoryCap x51 x52; capb = arch_capability.PageDirectoryCap x51a x52a\<rbrakk> \<Longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (x51 = x51a) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51_ x52_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.PageDirectoryCap x51_ x52_; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 9 \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51_ x52_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.PageDirectoryCap x51_ x52_; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size = Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 9 \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false
 2. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51_ x52_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.PageDirectoryCap x51_ x52_; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 9 \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51_ x52_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap x31_ x32_ x33_ vmpage_size option)) cap_b; capa = arch_capability.PageDirectoryCap x51_ x52_; capb = arch_capability.PageCap x31_ x32_ x33_ vmpage_size option; vmpage_size \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> cap_get_tag cap_b = 9 \<longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = SCAST(32 signed \<rightarrow> 32) false proof (prove)
goal (1 subgoal):
 1. \<And>x51 x52 x51a x52a. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51a x52a)) cap_b; capa = arch_capability.PageDirectoryCap x51 x52; capb = arch_capability.PageDirectoryCap x51a x52a\<rbrakk> \<Longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (x51 = x51a) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51_ x52_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51a_ x52a_)) cap_b; capa = arch_capability.PageDirectoryCap x51_ x52_; capb = arch_capability.PageDirectoryCap x51a_ x52a_\<rbrakk> \<Longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (x51_ = x51a_) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51_ x52_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51a_ x52a_)) cap_b; capa = arch_capability.PageDirectoryCap x51_ x52_; capb = arch_capability.PageDirectoryCap x51a_ x52a_; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (x51_ = x51a_) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51_ x52_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51a_ x52a_)) cap_b; capa = arch_capability.PageDirectoryCap x51_ x52_; capb = arch_capability.PageDirectoryCap x51a_ x52a_; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (x51_ = x51a_) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51_ x52_)) cap_a; ccap_relation (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51a_ x52a_)) cap_b; capa = arch_capability.PageDirectoryCap x51_ x52_; capb = arch_capability.PageDirectoryCap x51a_ x52a_; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (x51_ = x51a_) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51_ x52_)) = (case cap_lift cap_a of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); Some (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51a_ x52a_)) = (case cap_lift cap_b of None \<Rightarrow> None | Some x \<Rightarrow> Some (cap_to_H x)); capa = arch_capability.PageDirectoryCap x51_ x52_; capb = arch_capability.PageDirectoryCap x51a_ x52a_; cap_get_tag cap_b = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap; cap_get_tag cap_a = SCAST(32 signed \<rightarrow> 32) cap_page_directory_cap\<rbrakk> \<Longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (x51_ = x51a_) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capability.ArchObjectCap (arch_capability.PageDirectoryCap x51_ x52_) = cap_to_H (Cap_page_directory_cap (cap_page_directory_cap_lift cap_a)); capability.ArchObjectCap (arch_capability.PageDirectoryCap x51a_ x52a_) = cap_to_H (Cap_page_directory_cap (cap_page_directory_cap_lift cap_b)); capa = arch_capability.PageDirectoryCap x51_ x52_; capb = arch_capability.PageDirectoryCap x51a_ x52a_; cap_lift cap_b = Some (Cap_page_directory_cap (cap_page_directory_cap_lift cap_b)); cap_lift cap_a = Some (Cap_page_directory_cap (cap_page_directory_cap_lift cap_a))\<rbrakk> \<Longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (x51_ = x51a_) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x51_ = capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) \<and> x52_ = (if to_bool (capPDIsMapped_CL (cap_page_directory_cap_lift cap_a)) then Some (capPDMappedASID_CL (cap_page_directory_cap_lift cap_a)) else None); x51a_ = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) \<and> x52a_ = (if to_bool (capPDIsMapped_CL (cap_page_directory_cap_lift cap_b)) then Some (capPDMappedASID_CL (cap_page_directory_cap_lift cap_b)) else None); capa = arch_capability.PageDirectoryCap (capPDBasePtr_CL (cap_page_directory_cap_lift cap_a)) (if to_bool (capPDIsMapped_CL (cap_page_directory_cap_lift cap_a)) then Some (capPDMappedASID_CL (cap_page_directory_cap_lift cap_a)) else None); capb = arch_capability.PageDirectoryCap (capPDBasePtr_CL (cap_page_directory_cap_lift cap_b)) (if to_bool (capPDIsMapped_CL (cap_page_directory_cap_lift cap_b)) then Some (capPDMappedASID_CL (cap_page_directory_cap_lift cap_b)) else None); cap_lift cap_b = Some (Cap_page_directory_cap (cap_page_directory_cap_lift cap_b)); cap_lift cap_a = Some (Cap_page_directory_cap (cap_page_directory_cap_lift cap_a))\<rbrakk> \<Longrightarrow> (if capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b) then 1 else 0) = from_bool (capPDBasePtr_CL (cap_page_directory_cap_lift cap_a) = capPDBasePtr_CL (cap_page_directory_cap_lift cap_b)) proof (prove)
goal:
No subgoals! proof (prove)
goal:
No subgoals!